Is it possible to fake a specific path for a process?
LD_PRELOAD isn't too difficult, and you don't need to be root.
Interpose your own C routine which is called instead of the real open()
in the C library. Your routine checks if the file to open is "/tmp/adb.log" and calls the real open with a different filename. Here's your shim_open.c:
/*
* capture calls to a routine and replace with your code
* gcc -Wall -O2 -fpic -shared -ldl -o shim_open.so shim_open.c
* LD_PRELOAD=/.../shim_open.so cat /tmp/adb.log
*/
#define _FCNTL_H 1 /* hack for open() prototype */
#define _GNU_SOURCE /* needed to get RTLD_NEXT defined in dlfcn.h */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <dlfcn.h>
#define OLDNAME "/tmp/adb.log"
#define NEWNAME "/tmp/myadb.log"
int open(const char *pathname, int flags, mode_t mode){
static int (*real_open)(const char *pathname, int flags, mode_t mode) = NULL;
if (!real_open) {
real_open = dlsym(RTLD_NEXT, "open");
char *error = dlerror();
if (error != NULL) {
fprintf(stderr, "%s\n", error);
exit(1);
}
}
if (strcmp(pathname,OLDNAME)==0) pathname = NEWNAME;
fprintf(stderr, "opening: %s\n", pathname);
return real_open(pathname, flags, mode);
}
Compile it with gcc -Wall -O2 -fpic -shared -ldl -o shim_open.so shim_open.c
and test it by putting something in /tmp/myadb.log
and running
LD_PRELOAD=/.../shim_open.so cat /tmp/adb.log
. Then try the LD_PRELOAD on adb.
Here is a very simple example of using util-linux
's unshare
to put a process in a private mount namespace and give it a different view of the same filesystem its parent currently has:
{ cd /tmp #usually a safe place for this stuff
echo hey >file #some
echo there >file2 #evidence
sudo unshare -m sh -c ' #unshare requires root by default
mount -B file2 file #bind mount there over hey
cat file #show it
kill -TSTP "$$" #suspend root shell and switch back to parent
umount file #unbind there
cat file' #show it
cat file #root shell just suspended
fg #bring it back
cat file2 #round it off
}
there #root shell
hey #root shell suspended
hey #root shell restored
there #rounded
You can give a process a private view of its filesystem with the unshare
utility on up-to-date linux systems, though the mount namespace facility itself has been fairly mature for the entire 3.x kernel series. You can enter pre-existing namespaces of all kinds with nsenter
utility from the same package, and you can find out more with man
.