I know on a Linux machine, if a process is able to get root privilege, it can access parts of the file system it normally wouldn't have access to.

I want to ask whether a rooted Linux process can inspect memory of any other process on a system ? So if I have a process which contains a secret in its heap or stack, will a rooted process be able to access it, and if yes, how will it do it ?

(Whoever answers may also consider a rooted shell process; I'm just concerned about a process with root access)

  • 1
    A process with root can ptrace any other process and do whatever it likes to it. To include reading stack and heap, altering program code, randomly inducing segfaults.... – Tom Hunt Nov 5 '15 at 17:43


The root capabilities have been broken up. Now A process can have a subset of them (including root having none).

By looking at the man page of capabilities, we can see what root can (normally) do.

I include a few here:

          Bypass file read, write, and execute permission checks.  (DAC
          is an abbreviation of "discretionary access control".)

          Bypass permission checks for sending signals (see kill(2)).
          This includes use of the ioctl(2) KDSIGACCEPT operation.

          Bind a socket to Internet domain privileged ports (port
          numbers less than 1024).

          * Load and unload kernel modules (see init_module(2) and
          * in kernels before 2.6.25: drop capabilities from the system-
            wide capability bounding set.

          Set system clock (settimeofday(2), stime(2), adjtimex(2)); set
          real-time (hardware) clock.

          * Perform I/O port operations (iopl(2) and ioperm(2));
          * access /proc/kcore;
          * employ the FIBMAP ioctl(2) operation;
          * open devices for accessing x86 model-specific registers
            (MSRs, see msr(4));
          * update /proc/sys/vm/mmap_min_addr;
          * create memory mappings at addresses below the value
            specified by /proc/sys/vm/mmap_min_addr;
          * map files in /proc/bus/pci;
          * open /dev/mem and /dev/kmem;
          * perform various SCSI device commands;
          * perform certain operations on hpsa(4) and cciss(4) devices;
          * perform a range of device-specific operations on other

Of the ones shown here, CAP_SYS_MODULE could be used in load a kernel module that could do it; CAP_SYS_RAWIO could be used to open /dev/mem; There are other ways with other capabilities, including ptrace.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.