Search code examples
linuxdlopen

Disabling access to "exec" functions?


Let's say I have a process "A" that loads a dynamic library "L".

Q: Is there a way to disable access to the "exec" functions to functions inside "L"?


Solution

  • The dynamic library shares the same process space as the calling application, so it's definitely not easy (and I think not possible, without also denying it to your application). If you can wrap the library in a separate application, then AppArmor or SELinux may help, but in general: why are you loading an untrusted library into your application?

    You may also find that looking into how Chromium deals with sandboxing is helpful.