Home/ Questions/Q 7981707
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-04T10:27:25+00:00

I am studying for exam tomorrow and I ran across this question: After we

  • 0

I am studying for exam tomorrow and I ran across this question:

After we run an executable with strace the following syscalls result regarding standard C lib:

  • open(“/lib/libc.so.6”, “O_RDONLY”) = 3
  • mmap(NULL, 36803630, PROT_READ | PROT_EXEC, MAP_PRIVATE | MAP_DENYWRITE, 3, 0) =
    0x7f312ab35000
  • mmap(0x7f312aeae000, 20480, PROT_READ | PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x179000) = 0x7f312aeae000

The question is why does the first syscall of mmap uses PROT_READ|PROT_EXEC and the second one PROT_READ|PROT_WRITE.

Please explain me what happens after each mmap call in detail. I don’t understand why a process would need to modify libc (write access).

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The maps are private (MAP_PRIVATE), so nothing is modifying libc.so; instead, it’s modifying a private (to the process) copy of pages mapped from libc.so. This will include the data segment (global variables in libc) as well as the Global Offset Table (GOT) and perhaps other structures involved in relocating the library to a particular address at runtime.

    • 0