On Tue, May 4, 2021 at 4:56 AM Arkadiusz Kozdra (Arusekk)
<arek_koz@xxxxx> wrote:
>
> Some executable-inspecting tools (e.g. pwntools) rely on patching entry
> point instructions with minimal machine code that uses sendfile to read
> /proc/self/maps to stdout. The sendfile call allows them to do it
> without excessive allocations, which would change the mappings, and
> therefore distort the information.
So this was kind of what I was expecting.
The only reason to do this is basically for nefarious purposes, and
it's one of the reasons I didn't feel like doing splice() on
everything should be encouraged.
Yes, yes, I'm sure pwntools can be used by white hats, but honestly,
that seems to be an almost secondary purpose.
Why should the kernel _encourage_ and make it easy to do things like
this? What are the actual advantages for us to do this?
Linus
