News for hackers. Stuff that matters.

A comment on Unprivileged Process Injection Techniques in Linux.

Re:Unprivileged Process Injection Techniques in Linux by gavinray on Sunday December 31, 2023 @12:44PM (#38825873)
It's a bit wild, but you can use memfd_create to do things like load libraries or binaries, on a filesystem that has no read/write access and noexec enabled.

I have been meaning to do a blog post about this, since it doesn't seem to be common knowledge.

Originally, I thought of it as a response to a Reddit question: "How can I load a shared library from a .jar directly into memory?"

https://old.reddit.com/r/java/comments/15lcwil/load_shared_l...

[ Parent | on HN ]
Re:Unprivileged Process Injection Techniques in Linux by Retr0id on Sunday December 31, 2023 @01:12PM (#38826117)
> on a filesystem that has...

memfd_create's whole selling point is that it isn't backed by a filesystem; it isn't "on" one in the first place, so there is nowhere for it to inherit such restrictions from. The consequences of that can be surprising though, I agree, and are worth exploring and writing about.

[ Parent | on HN ]