Real World LD_PRELOAD Examples (II)

libtrash

• Intercepts calls to unlink(2), rename(2), open(2)

• Implements a "trash can", or "recycling bin"

• Any attempts to delete files results in them being moved to a specified directory, rather than being destroyed

auditunlink

• Adds a side-effect to unlink(2)

• Creates an audit-trail of processes that delete files