Skip to main content

fake_proc_status

Function fake_proc_status 

Source
fn fake_proc_status(text: &[u8], fake_root: Option<Ids>) -> Result<i32, i32>
Expand description

Serves /proc/<pid>/status with our own pid hidden from TracerPid and, under -0, root in the Uid/Gid lines.

Programs read that field to decide whether a debugger is attached and may change behaviour or trap when it is. A transparent supervisor must not show up there, so the file is copied into a memfd with the field zeroed.

§Arguments

  • text - The file as the kernel gives it.
  • fake_root - The virtual identity to show, under -0.

§Returns

A descriptor on the rewritten copy.