Follow up: How to write a Linux virus [LWN.net]

Follow up: How to write a Linux virus

Posted Feb 13, 2009 17:17 UTC (Fri) by iabervon (subscriber, #722)
In reply to: Follow up: How to write a Linux virus by tzafrir
Parent article: Follow up: How to write a Linux virus

Have the relevant section name depend on the basename of the executable; that's the usual way of having the same executable do different things when run. You just make a symlink to set it. The filesystem storage costs are probably less than the .desktop file anyway.

Java jars are zip archives with a directory for "what do you actually run". That's especially easy. a.out is hardly supported any more, and win32 goes with its own system (win32 executables depend on having a registry of some sort).

Scripts are kind of annoying, but there's probably an easy enough way to put something in them near the beginning using their native comment syntax plus a special tag.

(Log in to post comments)

Follow up: How to write a Linux virus

Posted Feb 13, 2009 20:46 UTC (Fri) by iabervon (subscriber, #722) [Link]

Add to the iceape binary these ELF sections:

.desktop.chatzilla:
  options:
    -chat\0\0
.desktop.iceape-addressbook:
  options:
    -addressbook\0\0
.desktop.iceape:
  filearg:
.desktop.iceape-navigator:
  filearg:
  options:
    -browser\0\0

symlink /usr/share/applications/{chatzilla,iceape,iceapi-navagator,etc} to the iceape binary.

In the dynamic linker, check for a .desktop.(basename of $0) section, and rewrite argv to have the given options, if any, between $0 and $1. In the launcher, offer a filename argument if the section has a "filearg" symbol. The launcher could also pull out other information, like icons, names, suitable MIME types, etc. And the launcher actually executes "/usr/share/applications/iceape foo", so if it's looking at isn't executable, it'll get an error.

As a bonus, you can actually execute these from the command line with the same effect that they have in the launcher.

Follow up: How to write a Linux virus

Posted Feb 14, 2009 8:34 UTC (Sat) by ringerc (subscriber, #3071) [Link]

The performance cost of that would be horrifying, as it'd force the linker to do all sorts of unnecessary work whenever it executed any process. Like, say `ps', `ls', `as', `gcc', etc.

You might be able to avoid that by borrowing a spare (if there is one) ELF header flag to indicate "this is a desktop application".

In all honstly, though if you're going to mangle things that much why not take NextSTEP / Apple's approach of .app dirs with self-contained metadata?

Anyway, none of these proposed solutions address things like users wanting to make their own app links, make custom launchers with different arguments to apps, add launchers for apps they've compiled themselves, etc. Making .desktop files require execute permissions would be a big step.