c++ - Can I dynamically link without giving read permission to the libraries? -


i have dynamically linked libraries protect unauthorized users. cannot use groups / acls this. have list of licensed users , can yes/no @ runtime whether given uid authorized. linux , gcc/clang, if matters.

it takes bit of work it's doable , still considered dynamic:

  1. make main program setuid-root (or grant cap_dac_override capability program -- see capabilities(7))

  2. when program executed, runtime authorization check

  3. if user authorized, use dlopen (along root/dac_override) load libraries. need use dlsym find/resolve symbols need library.

  4. drop capability and/or revert uid best security.

(all being said, using group id simpler. can grant group membership users considered authorized.)


Comments