What would be an effect on the system when we try to forcefully delete /etc/ld.so.preload file? I have been doing my research around this command. rm -f /etc/ld.so.preload The script which currently I am analyzing, starts with above command. Note: I tried doing my research around "ld.so.preload" file and came to the conclusion that, `"ld.so.preload"` file normally doesn't exists on the system. Almost all programs try to open this file, this behavior is baked into glibc. Since the file isn't present on the process just calls access, gets negative value and moves on Questions: 1. In which cases the ld.so.preload file is normally present or create on the system ? 2. What will the effect on system when a malicious program forcefully tries and delete `ld.so.preload` file ? The original i.sh code came from DShield: A few IoCs related to CVE-2020-5902

1. In cases where your system is broken and program can't access the libs correctly
2. The effect will be that a system that was already in a bad condition will end up in a even worse condition



The reason that all programs try to access this file, even if it's not present, is that it tells the programs which libs to load first before doing anything else.
At that point in the execution the program does not yet know it doesn't exist so it has to try it.