Show HN: dlinject.py – Inject a .so into a running Linux process, without ptrace
The tl;dr of the technique is to use &#x2F;proc&#x2F;$pid&#x2F;mem to overwrite the stack. (Since you don&#x27;t have direct control of the instruction pointer this way, there&#x27;s some complexity in loading shellcode somewhere and having the process return to it to get it to usefully execute your code, much like an actual stack-corruption exploit.)<p>On a normal Linux system, &#x2F;proc&#x2F;$pid&#x2F;mem is protected by the same kernel permission check as ptrace, and a Linux security module like Yama, the thing that disables ptracing unrelated processes on Ubuntu etc., will also block this tool (which the README mentions). It seems like it&#x27;s mostly useful for cases where people are blocking the ptrace <i>syscall</i> (like Docker&#x27;s default syscall filter, maybe?) and not loading an LSM.<p>Cool demonstration that blocking the ptrace syscall isn&#x27;t sufficient. By the way, blocking &#x2F;proc too isn&#x27;t sufficient either: there&#x27;s the process_vm_writev and process_vm_readv syscalls that work like writing&#x2F;reading &#x2F;proc&#x2F;$pid&#x2F;mem. I think it&#x27;s harder to write a robust tool using only those syscalls, but I wouldn&#x27;t bet on it being impossible.<p>If you really want to do syscall filtering to confine an untrusted process (as opposed to reducing attack surface from potential bugs in otherwise-permissible syscalls, which is I think Docker&#x27;s goal), you need to start from empty and allow syscalls instead of starting from full and blocking them. Alternatively, maybe just run the untrusted code as another user account or something.