News for hackers. Stuff that matters.

A comment on Unprivileged Process Injection Techniques in Linux. Parent comment

Re:Unprivileged Process Injection Techniques in Linux by Retr0id on Sunday December 31, 2023 @12:41PM (#38825845)
In the case of stelf-loader, the bash instance is attacking itself. It's not especially unexpected for a process to be able to modify its own memory.
[ Parent | on HN ]
Re:Unprivileged Process Injection Techniques in Linux by charcircuit on Sunday December 31, 2023 @06:28PM (#38828398)
>It's not especially unexpected for a process to be able to modify its own memory.

It is unexpected for Bash to do that so it shouldn't be given access to ptrace.

[ Parent | on HN ]
Re:Unprivileged Process Injection Techniques in Linux by Retr0id on Sunday December 31, 2023 @06:55PM (#38828533)
stelf-loader does not use ptrace
[ Parent | on HN ]
Re:Unprivileged Process Injection Techniques in Linux by charcircuit on Sunday December 31, 2023 @07:38PM (#38828740)
Writing to /proc/pid/mem requires access to ptrace. I never said it would use ptrace directly.
[ Parent | on HN ]
Re:Unprivileged Process Injection Techniques in Linux by Retr0id on Monday January 01, 2024 @06:29AM (#38831136)
It's gated by the same access control logic that governs ptrace yes, but it does not use ptrace directly nor indirectly. The first step of that logic is:

> If the calling thread and the target thread are in the same thread group, access is always allowed.

[ Parent | on HN ]