0xcc byte writes to libc's code prove /proc/self/mem's punch-through power

This Hacker News post reveals how /proc/*/mem lets userspace programs write to otherwise unwritable memory. The author demonstrates writing a 0xcc (software breakpoint) byte to libc's getchar function, triggering a SIGTRAP when executed. This bypasses hardware restrictions like CR0.WP and SMAP, showing the kernel's ability to override MMU protections via FOLL_FORCE and kmap().

The article details how /proc/*/mem's implementation in fs/proc/base.c uses get_user_pages_remote() with FOLL_FORCE to ignore page permissions during lookup. It then physically maps the target frame into kernel space via kmap(), allowing writes without triggering page faults. This bypasses the CPU's CR0.WP write protection, which is typically enabled at boot but can be circumvented through this kernel mechanism.

The demonstration highlights a critical security nuance: while hardware enforces memory permissions, the kernel can deliberately override them for legitimate debugging and JIT purposes, fundamentally challenging the assumption that hardware is an absolute barrier to kernel memory access.