Re:OpenBSD may soon gain further memory protections: immutab...
by jcranmer on Friday September 02, 2022 @04:42PM
(#32695493)
> On the plus side, on Linux /proc/<pid>/environ is a snapshot created at the time of execve() and kept by the kernel, nothing other than execve() can change it (don't quote me on this, I'm only 90% sure.)
prctl(PR_SET_MM_ENV_{START,END}) will change the contents of /proc/<pid>/environ.
From what it looks like in Linux's source code, twiddling the bits at the base of the stack will also cause the procfs file to change--it seems to read directly from the process's memory. Ditto for /cmdline and /auxv, it seems.
Re:OpenBSD may soon gain further memory protections: immutab...
by eqvinox on Saturday September 03, 2022 @05:38AM
(#32700234)
Now I'm sad :(
… but Thanks for removing a misconception of mine!
Re:OpenBSD may soon gain further memory protections: immutab...
by staticassertion on Monday September 05, 2022 @03:40PM
(#32728438)
Yep, dug into this the other day and POC'd it to prove that (even without prctl, just direct writing) you can overwrite those values and that will be shown in proc.
Re:OpenBSD may soon gain further memory protections: immutab...
by 7vUYjPAG2fnx7fd on Friday September 02, 2022 @03:38PM
(#32694924)
No setproctitle on Linux. As far as I know you have to overwrite the argv space (and hopefully not also the environment space).
Re:OpenBSD may soon gain further memory protections: immutab...
by eqvinox on Saturday September 03, 2022 @05:40AM
(#32700242)
Looking at the sibling post to yours, I'm assuming the "better" approach these days is to allocate a new buffer distinct from argv space and use PR_SET_MM_ARG_{START,END} to point the kernel there.
Right, yeah.
> It would probably break the ANSI C standard though if you can't modify argv and environ though.
AFAIK it would also break setproctitle(), unless my memory is off that works by just writing over the argv space.
On the plus side, on Linux /proc/<pid>/environ is a snapshot created at the time of execve() and kept by the kernel, nothing other than execve() can change it (don't quote me on this, I'm only 90% sure.)