Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Setuid!

Then there’s miscellaneous stuff like cloexec. Not privileged, but atomic.

The binary you exec may load code at the same address you’re using for code, unless it’s PIE. Not insurmountable, but tricky.



Definitely tricky. I solved it with a Python implementation by building up a big jumpbuffer so that the moment I leave Python-land I copy from temporary buffers to the right addresses and then ultimately jump at the entry point of the newly loaded binary. It's tricky and took quite some debugging to get right, but it's proven rather solid now.

See https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.p... for details. Especially the `CodeGenerator` classes with implementations in x86, x86-64 and aarch64.


It's also essential for reliability to start from a clean slate (at least regarding memory, if not all resources -- why cloexec should be the default)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: