Do not trust process command lines! Part II

$ unshare -Umr
$ mount --bind /bin/bash /usr/sbin/arpd
$ exec /usr/sbin/arpd
$ # A hidden shell

$ pidof arpd
1692
$ readlink /proc/1692/exe
/usr/sbin/arpd
$ readlink /proc/$$/ns/mnt /proc/1692/ns/mnt
mnt:[4026531840]
mnt:[4026533296]

As mentioned in tip 37, it is also possible to fool /proc/PID/exe, here’s how: While /proc/PID/cmdline can easily be changed by overwriting its own argv[], the /proc/PID/exe symlink will still point to the original executable. If the process is privileged, things are straightforward. With the PR_SET_MM_EXE_FILE prctl, the link can be changed at will. Using Linux namespaces, it is also possible for an unprivileged process to trick most process utilities. Therefore, /proc/PID/exe can only be trusted when the mount (mnt) namespace IDs match!