add new linux rules to nursery

nursery/get-current-process-command-line.yml

@@ -0,0 +1,15 @@
+rule:
+  meta:
+    name: get current process command line
+    namespace: host-interation/process
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: thread
+  features:
+    - and:
+      - os: linux
+      - api: open
+      - string: "/proc/self/cmdline"
+      - api: read

nursery/get-current-process-file-path.yml

@@ -0,0 +1,14 @@
+rule:
+  meta:
+    name: get current process file path
+    # namespace: host-interation/process
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+  features:
+    - and:
+      - os: linux
+      - api: readlink
+      - string: "/proc/self/exe"

nursery/hook-routines-via-dlsym-rtld_next.yml

@@ -0,0 +1,22 @@
+rule:
+  meta:
+    name: hook routines via dlsym RTLD_NEXT
+    # namespace: linking/hooking
+    authors:
+      - [email protected]
+    scopes:
+      static: basic block
+      dynamic: call
+    references:
+      - https://stackoverflow.com/questions/71695007/hook-library-function-using-custom-method-using-dlsym
+      - https://liveoverflow.com/hooking-on-linux-with-ld_preload-pwn-adventure-3/
+  features:
+    - and:
+      - api: dlsym
+      - or:
+        - and:
+          - arch: i386
+          - number: 0xFFFFFFFF = RTLD_NEXT
+        - and:
+          - arch: amd64
+          - number: 0xFFFFFFFFFFFFFFFF = RTLD_NEXT