diff --git a/MANIFEST b/MANIFEST
index 9d0705a89..f2a75744e 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -1105,6 +1105,7 @@ src/exec.c
 src/exec_common.c
 src/exec_monitor.c
 src/exec_nopty.c
+src/exec_preload.c
 src/exec_pty.c
 src/get_pty.c
 src/hooks.c
diff --git a/src/Makefile.in b/src/Makefile.in
index 02cf51f87..60402a814 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -134,20 +134,23 @@ SHELL = @SHELL@
 PROGS = @PROGS@
 
 OBJS = conversation.o copy_file.o edit_open.o env_hooks.o exec.o \
-       exec_common.o exec_monitor.o exec_nopty.o exec_pty.o get_pty.o hooks.o \
-       intercept.pb-c.o limits.o load_plugins.o net_ifs.o parse_args.o \
-       preserve_fds.o signal.o sudo.o sudo_edit.o tcsetpgrp_nobg.o tgetpass.o \
-       ttyname.o utmp.o @SUDO_OBJS@
+       exec_common.o exec_monitor.o exec_nopty.o exec_preload.lo exec_pty.o \
+       get_pty.o hooks.o intercept.pb-c.lo limits.o load_plugins.o net_ifs.o \
+       parse_args.o preserve_fds.o signal.o sudo.o sudo_edit.o \
+       tcsetpgrp_nobg.o tgetpass.o ttyname.o utmp.o @SUDO_OBJS@
 
 IOBJS = $(OBJS:.o=.i) sesh.i
 
 POBJS = $(IOBJS:.i=.plog)
 
-SESH_OBJS = copy_file.o edit_open.o exec_common.o sesh.o
+SESH_OBJS = copy_file.o edit_open.o exec_common.o exec_preload.lo sesh.o
+
+INTERCEPT_OBJS = exec_preload.lo sudo_intercept.lo sudo_intercept_common.lo \
+		 intercept.pb-c.lo
 
 CHECK_NET_IFS_OBJS = check_net_ifs.o net_ifs.o
 
-CHECK_NOEXEC_OBJS = check_noexec.o exec_common.o
+CHECK_NOEXEC_OBJS = check_noexec.o exec_common.o exec_preload.lo
 
 CHECK_TTYNAME_OBJS = check_ttyname.o ttyname.o
 
@@ -201,8 +204,8 @@ $(devdir)/intercept.pb-c.c: $(srcdir)/intercept.proto
 sudo: $(OBJS) $(LT_LIBS) @STATIC_SUDOERS@
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) -o $@ $(OBJS) $(SUDO_LDFLAGS) $(ASAN_LDFLAGS) $(PIE_LDFLAGS) $(SSP_LDFLAGS) $(LIBS) @STATIC_SUDOERS@
 
-sudo_intercept.la: sudo_intercept.lo sudo_intercept_common.lo intercept.pb-c.lo
-	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) $(SSP_LDFLAGS) $(LT_LIBS) @LIBDL@ -o $@ sudo_intercept.lo sudo_intercept_common.lo intercept.pb-c.lo $(PRELOAD_MODULE) -avoid-version -rpath $(interceptdir) -shrext .so
+sudo_intercept.la: $(INTERCEPT_OBJS)
+	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) $(ASAN_LDFLAGS) $(SSP_LDFLAGS) $(LT_LIBS) @LIBDL@ -o $@ $(INTERCEPT_OBJS) $(PRELOAD_MODULE) -avoid-version -rpath $(interceptdir) -shrext .so
 
 sudo_noexec.la: sudo_noexec.lo
 	$(LIBTOOL) $(LTFLAGS) --mode=link $(CC) $(LDFLAGS) $(LT_LDFLAGS) $(SSP_LDFLAGS) @LIBDL@ -o $@ sudo_noexec.lo $(PRELOAD_MODULE) -avoid-version -rpath $(noexecdir) -shrext .so
@@ -344,22 +347,8 @@ cleandir: realclean
 .PHONY: clean mostlyclean distclean cleandir clobber realclean
 
 # *Not* auto-generated to avoid building with ASAN
-sudo_intercept.lo: $(srcdir)/sudo_intercept.c $(incdir)/sudo_compat.h \
-                   $(top_builddir)/config.h $(top_builddir)/pathnames.h
-	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_intercept.c
-
-sudo_intercept_common.lo: $(srcdir)/sudo_intercept_common.c \
-			  $(incdir)/sudo_compat.h $(incdir)/sudo_fatal.h \
-			  $(incdir)/sudo_gettext.h $(incdir)/intercept.pb-c.h \
-			  $(srcdir)/sudo_exec.h $(top_builddir)/config.h
-	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_intercept_common.c
-
-intercept.pb-c.lo: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
-                   $(incdir)/protobuf-c/protobuf-c.h
-	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/intercept.pb-c.c
-
 sudo_noexec.lo: $(srcdir)/sudo_noexec.c $(incdir)/sudo_compat.h \
-                $(top_builddir)/config.h $(top_builddir)/pathnames.h
+		$(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_noexec.c
 
 # Autogenerated dependencies, do not modify
@@ -477,14 +466,16 @@ env_hooks.i: $(srcdir)/env_hooks.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 env_hooks.plog: env_hooks.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/env_hooks.c --i-file $< --output-file $@
-exec.o: $(srcdir)/exec.c $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+exec.o: $(srcdir)/exec.c $(incdir)/compat/stdbool.h $(incdir)/intercept.pb-c.h \
+        $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \
         $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
         $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
         $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
         $(srcdir)/sudo.h $(srcdir)/sudo_exec.h $(srcdir)/sudo_plugin_int.h \
         $(top_builddir)/config.h $(top_builddir)/pathnames.h
 	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/exec.c
-exec.i: $(srcdir)/exec.c $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
+exec.i: $(srcdir)/exec.c $(incdir)/compat/stdbool.h $(incdir)/intercept.pb-c.h \
+        $(incdir)/protobuf-c/protobuf-c.h $(incdir)/sudo_compat.h \
         $(incdir)/sudo_conf.h $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
         $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
         $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h $(incdir)/sudo_util.h \
@@ -551,6 +542,24 @@ exec_nopty.i: $(srcdir)/exec_nopty.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 exec_nopty.plog: exec_nopty.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/exec_nopty.c --i-file $< --output-file $@
+exec_preload.lo: $(srcdir)/exec_preload.c $(incdir)/compat/stdbool.h \
+                 $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                 $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
+                 $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
+                 $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                 $(incdir)/sudo_util.h $(srcdir)/sudo.h $(srcdir)/sudo_exec.h \
+                 $(top_builddir)/config.h $(top_builddir)/pathnames.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/exec_preload.c
+exec_preload.i: $(srcdir)/exec_preload.c $(incdir)/compat/stdbool.h \
+                 $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                 $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
+                 $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
+                 $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                 $(incdir)/sudo_util.h $(srcdir)/sudo.h $(srcdir)/sudo_exec.h \
+                 $(top_builddir)/config.h $(top_builddir)/pathnames.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+exec_preload.plog: exec_preload.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/exec_preload.c --i-file $< --output-file $@
 exec_pty.o: $(srcdir)/exec_pty.c $(incdir)/compat/stdbool.h \
             $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
             $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
@@ -605,11 +614,11 @@ hooks.i: $(srcdir)/hooks.c $(incdir)/compat/stdbool.h $(incdir)/sudo_compat.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 hooks.plog: hooks.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/hooks.c --i-file $< --output-file $@
-intercept.pb-c.o: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
-                  $(incdir)/protobuf-c/protobuf-c.h
-	$(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/intercept.pb-c.c
+intercept.pb-c.lo: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
+                   $(incdir)/protobuf-c/protobuf-c.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/intercept.pb-c.c
 intercept.pb-c.i: $(srcdir)/intercept.pb-c.c $(incdir)/intercept.pb-c.h \
-                  $(incdir)/protobuf-c/protobuf-c.h
+                   $(incdir)/protobuf-c/protobuf-c.h
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 intercept.pb-c.plog: intercept.pb-c.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/intercept.pb-c.c --i-file $< --output-file $@
@@ -833,6 +842,36 @@ sudo_edit.i: $(srcdir)/sudo_edit.c $(incdir)/compat/stdbool.h \
 	$(CC) -E -o $@ $(CPPFLAGS) $<
 sudo_edit.plog: sudo_edit.i
 	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sudo_edit.c --i-file $< --output-file $@
+sudo_intercept.lo: $(srcdir)/sudo_intercept.c $(incdir)/compat/stdbool.h \
+                   $(incdir)/sudo_compat.h $(top_builddir)/config.h \
+                   $(top_builddir)/pathnames.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_intercept.c
+sudo_intercept.i: $(srcdir)/sudo_intercept.c $(incdir)/compat/stdbool.h \
+                   $(incdir)/sudo_compat.h $(top_builddir)/config.h \
+                   $(top_builddir)/pathnames.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+sudo_intercept.plog: sudo_intercept.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sudo_intercept.c --i-file $< --output-file $@
+sudo_intercept_common.lo: $(srcdir)/sudo_intercept_common.c \
+                          $(incdir)/compat/stdbool.h \
+                          $(incdir)/intercept.pb-c.h \
+                          $(incdir)/protobuf-c/protobuf-c.h \
+                          $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                          $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
+                          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                          $(srcdir)/sudo_exec.h $(top_builddir)/config.h
+	$(LIBTOOL) $(LTFLAGS) --mode=compile $(CC) -c $(CPPFLAGS) $(CFLAGS) $(ASAN_CFLAGS) $(PIE_CFLAGS) $(SSP_CFLAGS) $(srcdir)/sudo_intercept_common.c
+sudo_intercept_common.i: $(srcdir)/sudo_intercept_common.c \
+                          $(incdir)/compat/stdbool.h \
+                          $(incdir)/intercept.pb-c.h \
+                          $(incdir)/protobuf-c/protobuf-c.h \
+                          $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
+                          $(incdir)/sudo_fatal.h $(incdir)/sudo_gettext.h \
+                          $(incdir)/sudo_plugin.h $(incdir)/sudo_queue.h \
+                          $(srcdir)/sudo_exec.h $(top_builddir)/config.h
+	$(CC) -E -o $@ $(CPPFLAGS) $<
+sudo_intercept_common.plog: sudo_intercept_common.i
+	rm -f $@; pvs-studio --cfg $(PVS_CFG) --sourcetree-root $(top_srcdir) --skip-cl-exe yes --source-file $(srcdir)/sudo_intercept_common.c --i-file $< --output-file $@
 tcsetpgrp_nobg.o: $(srcdir)/tcsetpgrp_nobg.c $(incdir)/compat/stdbool.h \
                   $(incdir)/sudo_compat.h $(incdir)/sudo_conf.h \
                   $(incdir)/sudo_debug.h $(incdir)/sudo_event.h \
diff --git a/src/exec_common.c b/src/exec_common.c
index 7c6a8a7e2..467969148 100644
--- a/src/exec_common.c
+++ b/src/exec_common.c
@@ -36,125 +36,6 @@
 #include "sudo.h"
 #include "sudo_exec.h"
 
-#ifdef RTLD_PRELOAD_VAR
-/*
- * Add a DSO file to LD_PRELOAD or the system equivalent.
- */
-static char **
-preload_dso(char *envp[], const char *dso_file, char * const extra_envp[])
-{
-    char *preload = NULL;
-    int env_len, extra_len = 0;
-    int preload_idx = -1;
-    bool present = false;
-# ifdef RTLD_PRELOAD_ENABLE_VAR
-    bool enabled = false;
-# else
-    const bool enabled = true;
-# endif
-    debug_decl(preload_dso, SUDO_DEBUG_UTIL);
-
-    /*
-     * Preload a DSO file.  For a list of LD_PRELOAD-alikes, see
-     * http://www.fortran-2000.com/ArnaudRecipes/sharedlib.html
-     * XXX - need to support 32-bit and 64-bit variants
-     */
-
-    /* Count entries in envp, looking for LD_PRELOAD as we go. */
-    for (env_len = 0; envp[env_len] != NULL; env_len++) {
-	if (preload_idx == -1 && strncmp(envp[env_len], RTLD_PRELOAD_VAR "=",
-	    sizeof(RTLD_PRELOAD_VAR)) == 0) {
-	    const char *cp = envp[env_len] + sizeof(RTLD_PRELOAD_VAR);
-	    const char *end = cp + strlen(cp);
-	    const char *ep;
-	    const size_t dso_len = strlen(dso_file);
-
-	    /* Check to see if dso_file is already present. */
-	    for (cp = sudo_strsplit(cp, end, RTLD_PRELOAD_DELIM, &ep);
-		cp != NULL; cp = sudo_strsplit(NULL, end, RTLD_PRELOAD_DELIM,
-		&ep)) {
-		if ((size_t)(ep - cp) == dso_len) {
-		    if (memcmp(cp, dso_file, dso_len) == 0) {
-			/* already present */
-			present = true;
-			break;
-		    }
-		}
-	    }
-
-	    /* Save index of existing LD_PRELOAD variable. */
-	    preload_idx = env_len;
-	    continue;
-	}
-# ifdef RTLD_PRELOAD_ENABLE_VAR
-	if (strncmp(envp[env_len], RTLD_PRELOAD_ENABLE_VAR "=", sizeof(RTLD_PRELOAD_ENABLE_VAR)) == 0) {
-	    enabled = true;
-	    continue;
-	}
-# endif
-    }
-    if (extra_envp != NULL) {
-	for (extra_len = 0; extra_envp[extra_len] != NULL; extra_len++) {
-	    continue;
-	}
-    }
-
-    /*
-     * Make a new copy of envp as needed.
-     * It would be nice to realloc the old envp[] but we don't know
-     * whether it was dynamically allocated. [TODO: plugin API]
-     */
-    if (preload_idx == -1 || !enabled || extra_len != 0) {
-	const int env_size = env_len + 1 + (preload_idx == -1) + enabled + extra_len; // -V547
-
-	char **nenvp = reallocarray(NULL, env_size, sizeof(*envp));
-	if (nenvp == NULL)
-	    sudo_fatalx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
-	memcpy(nenvp, envp, env_len * sizeof(*envp));
-	if (extra_envp != NULL) {
-	    for (extra_len = 0; extra_envp[extra_len] != NULL; extra_len++)
-		nenvp[env_len++] = extra_envp[extra_len];
-	}
-	nenvp[env_len] = NULL;
-	envp = nenvp;
-    }
-
-    /* Prepend our LD_PRELOAD to existing value or add new entry at the end. */
-    if (!present) {
-	if (preload_idx == -1) {
-# ifdef RTLD_PRELOAD_DEFAULT
-	    asprintf(&preload, "%s=%s%s%s", RTLD_PRELOAD_VAR, dso_file,
-		RTLD_PRELOAD_DELIM, RTLD_PRELOAD_DEFAULT);
-# else
-	    preload = sudo_new_key_val(RTLD_PRELOAD_VAR, dso_file);
-# endif
-	    if (preload == NULL) {
-		sudo_fatalx(U_("%s: %s"), __func__,
-		    U_("unable to allocate memory"));
-	    }
-	    envp[env_len++] = preload;
-	    envp[env_len] = NULL;
-	} else {
-	    int len = asprintf(&preload, "%s=%s%s%s", RTLD_PRELOAD_VAR,
-		dso_file, RTLD_PRELOAD_DELIM, envp[preload_idx]);
-	    if (len == -1) {
-		sudo_fatalx(U_("%s: %s"), __func__,
-		    U_("unable to allocate memory"));
-	    }
-	    envp[preload_idx] = preload;
-	}
-    }
-# ifdef RTLD_PRELOAD_ENABLE_VAR
-    if (!enabled) {
-	envp[env_len++] = RTLD_PRELOAD_ENABLE_VAR "=";
-	envp[env_len] = NULL;
-    }
-# endif
-
-    debug_return_ptr(envp);
-}
-#endif /* RTLD_PRELOAD_VAR */
-
 /*
  * Disable execution of child processes in the command we are about
  * to run.  On systems with privilege sets, we can remove the exec
@@ -177,7 +58,7 @@ disable_execute(char *envp[], const char *dso)
 
 #ifdef RTLD_PRELOAD_VAR
     if (dso != NULL)
-	envp = preload_dso(envp, dso, NULL);
+	envp = sudo_preload_dso(envp, dso, -1);
 #endif /* RTLD_PRELOAD_VAR */
 
     debug_return_ptr(envp);
@@ -191,7 +72,6 @@ static char **
 enable_intercept(char *envp[], const char *dso, int intercept_fd)
 {
 #ifdef RTLD_PRELOAD_VAR
-    char *env_add[] = { NULL, NULL };
     debug_decl(enable_intercept, SUDO_DEBUG_UTIL);
 
     if (dso == NULL)
@@ -204,9 +84,7 @@ enable_intercept(char *envp[], const char *dso, int intercept_fd)
 	if (intercept_fd == -1)
 	    sudo_fatal("%s", U_("unable to dup intercept fd"));
     }
-    if (asprintf(&env_add[0], "SUDO_INTERCEPT_FD=%d", intercept_fd) == -1)
-	debug_return_ptr(NULL);
-    envp = preload_dso(envp, dso, env_add);
+    envp = sudo_preload_dso(envp, dso, intercept_fd);
 #else
     /* Intercept not supported, envp unchanged. */
     if (intercept_fd != -1)
diff --git a/src/exec_preload.c b/src/exec_preload.c
new file mode 100644
index 000000000..a10df23be
--- /dev/null
+++ b/src/exec_preload.c
@@ -0,0 +1,199 @@
+/*
+ * SPDX-License-Identifier: ISC
+ *
+ * Copyright (c) 2009-2021 Todd C. Miller <Todd.Miller@sudo.ws>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This is an open source non-commercial project. Dear PVS-Studio, please check it.
+ * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
+ */
+
+#include <config.h>
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "sudo.h"
+#include "sudo_exec.h"
+
+#ifdef RTLD_PRELOAD_VAR
+/*
+ * Add a DSO file to LD_PRELOAD or the system equivalent.
+ */
+char **
+sudo_preload_dso(char *envp[], const char *dso_file, int intercept_fd)
+{
+    char *preload = NULL;
+    int env_len;
+    int preload_idx = -1;
+    int intercept_idx = -1;
+    bool fd_present = false;
+    bool dso_present = false;
+# ifdef RTLD_PRELOAD_ENABLE_VAR
+    bool dso_enabled = false;
+# else
+    const bool dso_enabled = true;
+# endif
+    debug_decl(sudo_preload_dso, SUDO_DEBUG_UTIL);
+
+    /*
+     * Preload a DSO file.  For a list of LD_PRELOAD-alikes, see
+     * http://www.fortran-2000.com/ArnaudRecipes/sharedlib.html
+     * XXX - need to support 32-bit and 64-bit variants
+     */
+
+    /* Count entries in envp, looking for LD_PRELOAD as we go. */
+    /* XXX - If multiple LD_PRELOAD should remove extras */
+    for (env_len = 0; envp[env_len] != NULL; env_len++) {
+	if (strncmp(envp[env_len], RTLD_PRELOAD_VAR "=", sizeof(RTLD_PRELOAD_VAR)) == 0) {
+	    if (preload_idx == -1) {
+		const char *cp = envp[env_len] + sizeof(RTLD_PRELOAD_VAR);
+		const char *end = cp + strlen(cp);
+		const char *ep;
+		const size_t dso_len = strlen(dso_file);
+
+		/* Check to see if dso_file is already present. */
+		for (cp = sudo_strsplit(cp, end, RTLD_PRELOAD_DELIM, &ep);
+		    cp != NULL; cp = sudo_strsplit(NULL, end, RTLD_PRELOAD_DELIM,
+		    &ep)) {
+		    if ((size_t)(ep - cp) == dso_len) {
+			if (memcmp(cp, dso_file, dso_len) == 0) {
+			    /* already present */
+			    dso_present = true;
+			    break;
+			}
+		    }
+		}
+
+		/* Save index of existing LD_PRELOAD variable. */
+		preload_idx = env_len;
+	    } else {
+		/* Remove duplicate LD_PRELOAD. */
+		int i;
+		for (i = env_len; envp[i] != NULL; i++) {
+		    envp[i] = envp[i + 1];
+		}
+	    }
+	    continue;
+	}
+	if (intercept_fd != -1 && strncmp(envp[env_len], "SUDO_INTERCEPT_FD=",
+		sizeof("SUDO_INTERCEPT_FD=")) == 0) {
+	    if (intercept_idx == -1) {
+		const char *cp = envp[env_len] + sizeof("SUDO_INTERCEPT_FD=");
+		const char *errstr;
+		int fd;
+
+		fd = sudo_strtonum(cp, 0, INT_MAX, &errstr);
+		if (fd == intercept_fd && errstr == NULL)
+		    fd_present = true;
+
+		/* Save index of existing SUDO_INTERCEPT_FD variable. */
+		intercept_idx = env_len;
+	    } else {
+		/* Remove duplicate SUDO_INTERCEPT_FD. */
+		int i;
+		for (i = env_len; envp[i] != NULL; i++) {
+		    envp[i] = envp[i + 1];
+		}
+	    }
+	    continue;
+	}
+# ifdef RTLD_PRELOAD_ENABLE_VAR
+	if (strncmp(envp[env_len], RTLD_PRELOAD_ENABLE_VAR "=", sizeof(RTLD_PRELOAD_ENABLE_VAR)) == 0) {
+	    dso_enabled = true;
+	    continue;
+	}
+# endif
+    }
+
+    /*
+     * Make a new copy of envp as needed.
+     * It would be nice to realloc the old envp[] but we don't know
+     * whether it was dynamically allocated. [TODO: plugin API]
+     */
+    if (preload_idx == -1 || !dso_enabled || intercept_idx == -1) {
+	const int env_size = env_len + 1 + (preload_idx == -1) + dso_enabled + (intercept_idx == -1); // -V547
+
+	char **nenvp = reallocarray(NULL, env_size, sizeof(*envp));
+	if (nenvp == NULL) {
+	    sudo_warnx(U_("%s: %s"), __func__, U_("unable to allocate memory"));
+	    debug_return_ptr(NULL);
+	}
+	memcpy(nenvp, envp, env_len * sizeof(*envp));
+	nenvp[env_len] = NULL;
+	envp = nenvp;
+    }
+
+    /* Prepend our LD_PRELOAD to existing value or add new entry at the end. */
+    if (!dso_present) {
+	if (preload_idx == -1) {
+# ifdef RTLD_PRELOAD_DEFAULT
+	    asprintf(&preload, "%s=%s%s%s", RTLD_PRELOAD_VAR, dso_file,
+		RTLD_PRELOAD_DELIM, RTLD_PRELOAD_DEFAULT);
+# else
+	    preload = sudo_new_key_val(RTLD_PRELOAD_VAR, dso_file);
+# endif
+	    if (preload == NULL) {
+		sudo_warnx(U_("%s: %s"), __func__,
+		    U_("unable to allocate memory"));
+		/* XXX - leak */
+		debug_return_ptr(NULL);
+	    }
+	    envp[env_len++] = preload;
+	    envp[env_len] = NULL;
+	} else {
+	    int len = asprintf(&preload, "%s=%s%s%s", RTLD_PRELOAD_VAR,
+		dso_file, RTLD_PRELOAD_DELIM, envp[preload_idx]);
+	    if (len == -1) {
+		sudo_warnx(U_("%s: %s"), __func__,
+		    U_("unable to allocate memory"));
+		/* XXX - leak */
+		debug_return_ptr(NULL);
+	    }
+	    envp[preload_idx] = preload;
+	}
+    }
+# ifdef RTLD_PRELOAD_ENABLE_VAR
+    if (!dso_enabled) {
+	envp[env_len++] = RTLD_PRELOAD_ENABLE_VAR "=";
+	envp[env_len] = NULL;
+    }
+# endif
+    if (!fd_present && intercept_fd != -1) {
+	char *fdstr;
+	int len;
+
+	len = asprintf(&fdstr, "SUDO_INTERCEPT_FD=%d", intercept_fd);
+	if (len == -1) {
+	    sudo_warnx(U_("%s: %s"), __func__,
+		U_("unable to allocate memory"));
+	    /* XXX - leak */
+	    debug_return_ptr(NULL);
+	}
+	if (intercept_idx != -1) {
+	    envp[preload_idx] = fdstr;
+	} else {
+	    envp[env_len++] = fdstr;
+	    envp[env_len] = NULL;
+	}
+    }
+
+    debug_return_ptr(envp);
+}
+#endif /* RTLD_PRELOAD_VAR */
diff --git a/src/sudo_exec.h b/src/sudo_exec.h
index 0ca1b20dd..1bc2c84d3 100644
--- a/src/sudo_exec.h
+++ b/src/sudo_exec.h
@@ -117,4 +117,7 @@ bool utmp_login(const char *from_line, const char *to_line, int ttyfd,
     const char *user);
 bool utmp_logout(const char *line, int status);
 
+/* exec_preload.c */
+char **sudo_preload_dso(char *envp[], const char *dso_file, int intercept_fd);
+
 #endif /* SUDO_EXEC_H */
diff --git a/src/sudo_intercept.c b/src/sudo_intercept.c
index 95d5cc340..dcecd2514 100644
--- a/src/sudo_intercept.c
+++ b/src/sudo_intercept.c
@@ -63,14 +63,19 @@ my_execve(const char *cmnd, char * const argv[], char * const envp[])
 {
     char *ncmnd = NULL, **nargv = NULL, **nenvp = NULL;
 
-    /* XXX - add SUDO_INTERCEPT_FD to environment as needed. */
     if (command_allowed(cmnd, argv, envp, &ncmnd, &nargv, &nenvp)) {
 	/* Execute the command using the "real" execve() function. */
 	execve(ncmnd, nargv, nenvp);
     } else {
 	errno = EACCES;
     }
-    /* XXX - free ncmnd, nargv, nenvp */
+    if (ncmnd != cmnd)
+	free(ncmnd);
+    if (nargv != argv)
+	free(nargv);
+    if (nenvp != envp)
+	free(nenvp);
+
     return -1;
 }
 
@@ -113,14 +118,19 @@ execve(const char *cmnd, char * const argv[], char * const envp[])
         return -1;
     }
 
-    /* XXX - add SUDO_INTERCEPT_FD to environment as needed. */
     if (command_allowed(cmnd, argv, envp, &ncmnd, &nargv, &nenvp)) {
 	/* Execute the command using the "real" execve() function. */
 	return ((sudo_fn_execve_t)fn)(ncmnd, nargv, nenvp);
     } else {
 	errno = EACCES;
     }
-    /* XXX - free ncmnd, nargv, nenvp */
+    if (ncmnd != cmnd)
+	free(ncmnd);
+    if (nargv != argv)
+	free(nargv);
+    if (nenvp != envp)
+	free(nenvp);
+
     return -1;
 }
 #endif /* HAVE___INTERPOSE) */
diff --git a/src/sudo_intercept_common.c b/src/sudo_intercept_common.c
index 39c93839f..13704b829 100644
--- a/src/sudo_intercept_common.c
+++ b/src/sudo_intercept_common.c
@@ -44,6 +44,7 @@
 #define SUDO_ERROR_WRAP 0
 
 #include "sudo_compat.h"
+#include "sudo_conf.h"
 #include "sudo_fatal.h"
 #include "sudo_exec.h"
 #include "sudo_gettext.h"
@@ -51,7 +52,6 @@
 
 extern char **environ;
 
-static pid_t mainpid = -1;
 static int intercept_sock = -1;
 
 /*
@@ -66,7 +66,6 @@ sudo_interposer_init(void)
 
     if (!initialized) {
         initialized = true;
-        mainpid = getpid();
 
         /*
          * Missing SUDO_INTERCEPT_FD will result in execve() failure.
@@ -203,14 +202,6 @@ command_allowed(const char *cmnd, char * const argv[], char * const envp[],
         goto done;
     }
 
-    /* Don't allow the original process to be replaced. */
-    if (getpid() == mainpid) {
-	sudo_warnx("shell overwrite denied"); // XXX
-	// XXX debugging
-        errno = EACCES;
-        goto done;
-    }
-
     /*
      * We communicate with the main sudo process over a socket pair
      * which is passed over the intercept_sock.  The reason for not
@@ -285,8 +276,8 @@ command_allowed(const char *cmnd, char * const argv[], char * const envp[],
 	    (*nargv)[len] = strdup(res->u.accept_msg->run_argv[len]);
 	}
 	(*nargv)[len] = NULL;
-	/* XXX - add SUDO_INTERCEPT_FD to environment as needed. */
-	*nenvp = (char **)envp;
+	// XXX - bogus cast
+	*nenvp = sudo_preload_dso((char **)envp, sudo_conf_intercept_path(), intercept_sock);
 	ret = true;
 	break;
     case POLICY_CHECK_RESULT__TYPE_REJECT_MSG: