I have a program that requires presence of specific device in system (afaik it checks /proc/bus/pci/devices for against list of hardcoded vendor_id:device_id pairs). How could I fool this software to think that device is present without having it physically connected? Is there any way to add a line to /proc/bus/pci/devices or intercept syscall from specific program and change it?
1 Answer
You should run strace
on your program to figure out what "presence of specific device" means, exactly.
If it's really just reading that "file" as a normal file: well, easy, then just don't show the right file to that program!
That's what filesystem namespaces are for: isolating a program's view of the filesystem. (it's part of what container engines (think docker) tick.)
So, an unshare -m
might help, after which you can mess around with your /proc mount to your heart's delight (hint: mount it somewhere else, use that as lower layer in an overlayfs to fake a "better" /proc/bus/pci/devices, comes with a caveat).
Also: this sounds like a rather straightforward thing to runtime-patch into your program. Run to startup, open() a text file that contains the desired line, giving you a new file descriptor to that, watchpoint on the "open()" syscall, catch when it opens /proc/bus/pci/devices, and if it's that, instead of returning the file descriptor of that, give the file descriptor to the text file.
-
I used strace before. Thats how I figured out how it checks if device is present. There is no open() syscall in systrace btw. Only read(). After that I went into the rabbit hole of trying to intercept read syscall. unshare -m did the trick, Thank you very much!– AsffuJun 23, 2021 at 14:02
-
there has to be an
open
(or openat, or similar) call, otherwiseread
doesn't have anything to read from ;) read doesn't take a file name, it takes a file descriptor, and the only way to get these is toopen
them (or to get them sent via IPC, but let's not go there) Jun 23, 2021 at 14:09 -
1Indeed there are few openat() calls. I did not know that there are other syscalls for opening files. Idk how but I always chose hardest path to solve problem at hand. Guess it's my lack of deeper understanding. At least I learned some cool stuff like LD_PRELOAD trick on the way and this unshare command– AsffuJun 23, 2021 at 14:25