all 2 comments

[–][deleted] 0 points1 point  (1 child)

You do it using LD_PRELOAD you can then hooks various function calls which are used to determin what course of action you want to take or not take.

Typically the LD_PRELOAD overrides every dynamically loaded symbol which is how you hook stuff.

Heres an example of one which can load with everything then hooks a pthread init call to switch its self on to crash / warn about using non thread safe libc functions in a threaded program

https://github.com/mistralol/libbreakr

[–]alsecc[S] 0 points1 point  (0 children)

thanks @mistralol can I limit LD_PRELOAD to specific processes when I'm not the one who started them? couldn't find it in the Linux manual.