On Tue, May 4, 2021 at 4:56 AM Arkadiusz Kozdra (Arusekk)
[off-list ref] wrote:

Some executable-inspecting tools (e.g. pwntools) rely on patching entry
point instructions with minimal machine code that uses sendfile to read
/proc/self/maps to stdout.  The sendfile call allows them to do it
without excessive allocations, which would change the mappings, and
therefore distort the information.

So this was kind of what I was expecting.

The only reason to do this is basically for nefarious purposes, and
it's one of the reasons I didn't feel like doing splice() on
everything should be encouraged.

Yes, yes, I'm sure pwntools can be used by white hats, but honestly,
that seems to be an almost secondary purpose.

Why should the kernel _encourage_ and make it easy to do things like
this? What are the actual advantages for us to do this?

                 Linus