There's a bunch of ways to override it if you have early control over the process. Another example: ptrace the executable, watch the system calls, and skip ove

There's a bunch of ways to override it if you have early control over the process. Another example: ptrace the executable, watch the system calls, and skip over any mseal(2)s. This system call is meant for a different threat model than "attacker has early access to your process before it started initializing".