* Simon de Vlieger: > On Mon, Sep 7, 2026, at 2:20 PM, Florian Weimer via devel wrote: > >> 000000000001e740 <putenv>: >> - 1e740: f3 0f 1e fa endbr64 >> + 1e740: cc int3 >> + 1e741: 0f 1e fa nop %edx >> 1e744: 55 push %rbp >> 1e745: be 3d 00 00 00 mov $0x3d,%esi >> 1e74a: 48 89 e5 mov %rsp,%rbp >> @@ -33543,7 +33544,8 @@ >> 2027b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) >> >> 0000000000020280 <setenv>: >> - 20280: f3 0f 1e fa endbr64 >> + 20280: cc int3 >> + 20281: 0f 1e fa nop %edx >> 20284: 55 push %rbp >> 20285: 48 89 e5 mov %rsp,%rbp >> 20288: 48 83 ec 20 sub $0x20,%rsp >> @@ -33675,7 +33677,8 @@ >> 2047c: 00 00 00 00 >> >> 0000000000020480 <clearenv>: >> - 20480: f3 0f 1e fa endbr64 >> + 20480: cc int3 >> + 20481: 0f 1e fa nop %edx >> 20484: 55 push %rbp >> 20485: 31 c0 xor %eax,%eax >> 20487: ba 01 00 00 00 mov $0x1,%edx > > What does this do? It seems to SIGTRAP any call to environment modifying > functions, is something listening to those as "runtime integrity" protection > (or snooping) and if so what is that?
Those are kernel uprobes. Instead of trapping, the kernel runs an eBPF script when these functions are called. But it breaks tools that see these int3 instructions and interpret them as traps. Thanks, Florian -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
