You should just boot from a live USB (or CD/DVD) and rename
LD_PRELOAD doesn't work with setuid executables. But, if you want, you can use
/bin/busybox to do last-minute backups (that don't require running commands as root) before rebooting. It's possible to fix this without a live USB/CD/DVD, but you will still need to reboot, and I suggest using one.
LD_PRELOAD doesn't work with setuid commands.
Currently you are attempting to make
sudo use the renamed shared library by setting
LD_PRELOAD. This will not work. You cannot change what shared libraries
sudo links to with
LD_PRELOAD, and it doesn't work with any of the alternatives to
sudo either. If you could do this, then it would be an extremely severe security bug.
su) work to allow you to elevate privileges is that those executables have the setuid bit set0, which causes them to run as the user who owns them, which for those executables is the root user, rather than the user that actually runs them. When they run, they very carefully validate what you are asking them to do. In this way, provided their developers were careful enough, they will only allow users to perform actions they are authorized to perform.
LD_PRELOAD has no effect for setuid executables run by users other than their owners. This is absolutely vital for security. Otherwise, anybody could make their own library and force a program like
sudo to use it, and then anybody could gain root privileges. You can use
LD_PRELOAD to run non-setuid programs, and root can use it to run just about anything. But as a non-root user, you cannot use it to run programs like
su that are setuid root.
If you already had a root shell running then you wouldn't need to reboot. But even if you have the root account enabled--that is, even if you had a password set for it that you could use to log in as root with a command like
su--you would still not be able to fix the problem without rebooting. For example
su in Ubuntu also requires
libc.so.6 and is also setuid root so
LD_PRELOAD won't work with it either.1 (See also Peter Cordes's comments.)
The issue here is that the available mechanisms for performing actions as root require that you run setuid executables owned by root as yourself, but
LD_PRELOAD has no effect in that situation. If it weren't for the need to perform actions as root--or if you already had a root shell open--then you would be able to rename it back easily without rebooting and also without using
LD_PRELOAD. This is because Ubuntu systems have
/bin/busybox, which is statically linked. It lets you run many of the common *nix tools, including the
cp commands. You can run
/bin/busybox mv source destination or you can run just
/bin/busybox sh to get a shell in which you can then run the commands. Run
/bin/busybox with no arguments to get a list of supported commands. It even has a version of
You can back up files (if you want) and reboot to a live environment.
busybox chiefly because, although you will not be able to use it to gain root privileges and restore
libc.so.6, you can use it to back up any files you're concerned about losing before you reboot into a live environment. I very much doubt you would lose anything, but since you're concerned, you may want to use
busybox to copy any important files--like documents you've created or modified since your last backup--to another location.
Rebooting in the usual way may not get very far, because normal shutdowns actually involve running dynamically linked programs that depend on
libc.so.6. You may want to use Alt+SysRq+REISUB to reboot safely. This is not an ideal way to shut down, but it is probably better than a mostly ineffectual attempt to reboot followed by a hard reset. Another option would be to attempt to reboot and then attempt to use the REISUB method to take it the rest of the way. (If you want to power off the machine rather than rebooting it, use REISUO instead of REISUB.)
When you do boot from a live environment, renaming the file will be easy. You don't need to
chroot or do anything fancy. Just mount your root filesystem (which you can usually do with one click in the file browser, though you can use the
mount command if you like). Then, in a terminal, use the
cp command to restore
libc.so.6. You'll need
sudo, but that works fine in a live environment.
I know you mentioned you don't have a rescue disk. It would be difficult, perhaps impossible, to create a bootable live USB on that system, where you cannot run most programs. (You can use
busybox to copy and move files, and it even has a
dd comand, but I wouldn't recommend trying to use it for that. Usually you would need to be able to run
dd as root to create live media.) Perhaps someone will suggest a way. If you have another machine to put the hard disk in, hopefully you can create it with that machine. If not, your best bet may be to ask an acquaintance to make one.
There's a way without a live CD/DVD/USB, but you still must reboot.
However, there is an alternative to booting from external media.2 You will still have to reboot, but you don't need a live system. I don't especially recommend this, as it is cumbersome; using a live environment is easier. You can do it without one if you really want to, though.
As Zanna had previously pointed out in comments, rescue mode would not work because most programs need
libc.6.so (for example,
/bin/bash, which provides the shell, needs it). But you can boot the system with
/bin/busybox sh as init by passing
init=/bin/busybox sh as a boot option to the kernel in GRUB.3 This is essentially the same technique as the more common
init=/bin/bash) to get a root shell, but with
/bin/busybox sh instead of the regular
/bin/sh is dynamically linked and requires
If you want to do it this way, hold down the left Shift key while (re)booting so the GRUB boot menu appears. (If Shift doesn't work, use Esc.) With the arrow keys, select Advanced options for Ubuntu and press Enter. After this point you won't press Enter because that would boot normally rather than with custom boot options. Select any kernel and press e to edit its boot options temporarily. If there are multiple lines and your cursor is not on the line that starts with
linux, move it there with the arrow keys. Add
init=/bin/busybox sh to the end of that line and press F10 to boot it.
You should get a BusyBox shell prompt. You'll have to remount the root filesystem readwrite and rename
libc.so.6 so it has the correct name that it used to have. To achieve this, run these commands in the BusyBox shell (where other readers who have
libc.so.6 in a different location would have to adjust the directory name passed to the
mount -o remount,rw /
mv libc.so.6.bak libc.so.6
Then I recommend you then sync any cached writes to the filesystem, remount it readonly, and reboot:
mount -o remount,ro /
reboot command does not work at all in this situation, as no proper init daemon is running.)
0 For those who are interested: when those programs (like
sudo) actually run your command or create a shell as root or some other alternate user, both your real and effective user IDs are set to that of the target user. But when you run them, before they have done this, while they are determining if they should allow you to perform the action you have asked for, their effective user ID is that of root while their real user ID is still yours. I mention this to address a common misconception about the way real and effective user IDs work in programs like
sudo; if you've never heard of real and effective user IDs, feel free to ignore this footnote.
1 As mentioned,
busybox in Ubuntu is statically linked and does not rely on
libc.so.6. You might think you could use this to avoid rebooting, because
busybox offers a
su command. However, this does not help any, because as it is installed,
busybox is not setuid root. To actually work to allow a non-root user to become root,
su must be setuid root. The useful function of
busybox su is to allow root to impersonate other users, rather than to allow other users to impersonate root.
2 Zanna contributed greatly to this procedure and also did all the testing for it!
3 This succeeds at passing
busybox even though you might expect it to be interpreted as a subsequent kernel boot option. Including quotation marks prevents it from working. Note also that, in Ubuntu, the statically linked
busybox executable is just called
busybox-static (though the package that provides it is called
busybox-static). If you've uninstalled the statically linked BusyBox and installed the dynamically linked BusyBox, then this method won't work, but it's very unlikely that you have done that.