Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In-Memory-Only ELF Execution Without Tmpfs

magisterquis.github.io

Post reply on HN
Print view View original

21–24 of 24 posts

Re: In-Memory-Only ELF Execution Without Tmpfs

#21

Post by pwdisswordfish2 »

ifoundthetao wrote: post #11
pwdisswordfish2 wrote: post #2

Oh yeah, I've once discovered this method myself. With execveat() one can even avoid going through procfs. It doesn't work worth shbang-based scripts, though; that just returns ENOENT. Makes sense, I suppose.

Would you be willing to share how you did that (avoiding procfs too)?

Instead of

    snprintf(pathbuf, sizeof(pathbuf), "/proc/self/fd/%u", fd);
    execve(pathbuf, argv, envp);
you do

    execveat(fd, "", argv, envp, AT_EMPTY_PATH);
and that's it.

Re: In-Memory-Only ELF Execution Without Tmpfs

#22

Post by ifoundthetao »

pwdisswordfish2 wrote: post #21
ifoundthetao wrote: post #11

Earlier quoted context omitted.

Would you be willing to share how you did that (avoiding procfs too)?

Instead of snprintf(pathbuf, sizeof(pathbuf), "/proc/self/fd/%u", fd); execve(pathbuf, argv, envp); you do execveat(fd, "", argv, envp, AT_EMPTY_PATH); and that's it.

Thanks!!

Re: In-Memory-Only ELF Execution Without Tmpfs

#23

Post by the8472 »

justincormack wrote: post #14
ldng wrote: post #3

And when would you want to do that ? Really curious as I fail to see a usecase where the same goal could not be achieve otherwise. But there must be some otherwise the API would not have been introduced i guess.

It lets you execute files even with no writeable filesystem , which could be useful exploiting a locked down system. It is also an argument that locking down programs with no writeable fs is not sufficient for security. The memfd api has lots of other uses, the fact you can exec is just a byproduct.

> It is also an argument that locking down programs with no writeable fs is not sufficient for security.

It is in fact silly since write and execute are orthogonal. You can mount a filesystem as noexec. Although memfd does put a bullet into W^X aspirations.

Re: In-Memory-Only ELF Execution Without Tmpfs

#24

Post by jwilk »

jwilk wrote: post #20
joosters wrote: post #12

A bit off-topic, but their perl code is buggy. fork() returns undef on error, not -1. And you can use '$FH->autoflush(1)' instead of the eye-watering 'select((select($FH), $|=1)[0])'

I was going to say that you need to use the IO::Handle module to be able to use the autoflush method, but apparently this no longer necessary with modern Perl. From https://metacpan.org/pod/perl5120delta#Other-potentially-inc... : > Filehandles are now always blessed into IO::File. > The previous behaviour was to bless Filehandles into FileHandle (an empty proxy class) if it was loaded into memory and otherwise to bl…

On a second thought, this is probably the right changelog entry:

https://metacpan.org/pod/perl5140delta#Filehandle-method-cal...

When a method call on a filehandle would die because the method cannot be resolved and IO::File has not been loaded, Perl now loads IO::File via require and attempts method resolution again

Post reply on HN