3 ms·
Just the other day I was wondering why execve is a syscall in the first place, feels like lot of what its doing under the hood would really belong to userspace
by zokier 4y ago
Just the other day I was wondering why execve is a syscall in the first place, feels like lot of what its doing under the hood would really belong to userspace as it doesn't require special priveleges.
- klodolph 4y agoSetuid! Then there’s miscellaneous stuff like cloexec. Not privileged, but atomic. The binary you exec may load code at the same address you’re using for code, unless it’s PIE. Not insurmountable, but tricky.
- meandmymey234 4y agoDefinitely tricky. I solved it with a Python implementation by building up a big jumpbuffer so that the moment I leave Python-land I copy from temporary buffers to the right addresses and then ultimately jump at the entry point of the newly loaded binary. It's tricky and took quite some debugging to get right, but it's proven rather solid now. See https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.py https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.p... for details. Especially the `CodeGenerator` classes with implementations in x86, x86-64 and aarch64.
- silon42 4y agoIt's also essential for reliability to start from a clean slate (at least regarding memory, if not all resources -- why cloexec should be the default)