Chmod has to be hooked because if the LIB_PATH or /etc/ld.so.preload is not at least world-readable normal users won't be affected by the rootkit