Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <YIqFcHj3O2t+JJak@kroah.com> <20210504115358.20741-1-arek_koz@o2.pl>
In-Reply-To: <20210504115358.20741-1-arek_koz@o2.pl>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue, 4 May 2021 09:01:33 -0700
Message-ID: <CAHk-=whEjY7eOqPg2Ndw=iM2Mih0BC9LVyX9c6Uc_W=wmwnkkA@mail.gmail.com>
Subject: Re: [PATCH v3] proc: Use seq_read_iter for /proc/*/maps
To:     "Arkadiusz Kozdra (Arusekk)" <arek_koz@o2.pl>
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Christoph Hellwig <hch@lst.de>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        linux-fsdevel <linux-fsdevel@vger.kernel.org>,
        Alexey Dobriyan <adobriyan@gmail.com>,
        Al Viro <viro@zeniv.linux.org.uk>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, May 4, 2021 at 4:56 AM Arkadiusz Kozdra (Arusekk)
<arek_koz@o2.pl> wrote:
>
> Some executable-inspecting tools (e.g. pwntools) rely on patching entry
> point instructions with minimal machine code that uses sendfile to read
> /proc/self/maps to stdout.  The sendfile call allows them to do it
> without excessive allocations, which would change the mappings, and
> therefore distort the information.

So this was kind of what I was expecting.

The only reason to do this is basically for nefarious purposes, and
it's one of the reasons I didn't feel like doing splice() on
everything should be encouraged.

Yes, yes, I'm sure pwntools can be used by white hats, but honestly,
that seems to be an almost secondary purpose.

Why should the kernel _encourage_ and make it easy to do things like
this? What are the actual advantages for us to do this?

                 Linus