8

Theoreticly, if I know the pid of the bash shell which is running, I can run a cat whose stdout is redirected to the stdin of that shell. It seems to be as if I type something on that shell. Unfortunately, there WILL be stream coming from cat, BUT WILL NOT make the shell act properly (the entered command from cat will not be executed by bash).

Open a terminal:

ps -ef | grep bash
ymf       4906  4887  0 16:19 pts/0    00:00:00 /bin/bash

On another terminal:

cat 1> /proc/4906/fd/0
echo 'hello!'

Why?

11
  • 1
    Did you send the 'Return' key, too? As that would be needed to end a command.
    – boretom
    Mar 21, 2012 at 9:24
  • @boretom Of course I did. Mar 21, 2012 at 9:34
  • Yes, I see, interesting question. The input to bash seems to be redirected to the stdout. Try running a command like top and you'll see that the stdin is just add somewhere to the output. My guess is that since the shell is started as an interactive shell it won't accept commands from stdin. But that's pure speculation.
    – boretom
    Mar 21, 2012 at 9:43
  • While I'm no guru here, I think what you do is writing to the terminal emulator, and not to the process in question. IE you write to the right pipe junction, but it winds up in the wrong of the two pipes.
    – Eroen
    Mar 21, 2012 at 9:47
  • @boretom try ls -l /proc/PID/fd/. 0, 1, 2 are all redirected to /dev/pts/TERM_NUMER No matter whether it accepts commands from stdin, I'm sure of that fd0 is for input and I've already redirect the output of cat to it. Mar 22, 2012 at 12:58

3 Answers 3

7

I'm tired of the "one paragraph only" limit in comments =)

If you start a shell sh, and get the pid $pid you can find the file descriptors as you describe. An example:

$ ls -l /proc/29201/fd
total 0
lrwx------ 1 eroen users 64 Mar 22 15:52 0 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 1 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 2 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 255 -> /dev/pts/2

You will notice that 1, 2 and 3 are all symlinks to the same tty (a chardev). In other words, the input to the process is read from the same device node as the outputs are written to.

When you attempt to write (in a different process) to the same tty (as either /proc/$pid/fd/0 or /dev/pts/? you accomplish exactly the same thing as the process itself does when it writes data to it's output; the data shows up in the terminal window.

Actually changing where fd[0-2] point after starting a process is fairly complicated, but not impossible. Reptyr is a free open source application that modifies an existing process so it's fd[0-2] point to a different tty (as well as some other stuff). This is accomplished through the ptrace framework. The post also mentions other softwares that do the same thing, and that it can be done through gdb.

Depending on what you actually wanted to accomplish, you might find Reptyr or some other software does what you need. Otherwise, you can look at/copy/modify the source code and find out how they do the trick.

Addendum:
This contains a few illustrating diagrams, in particular the third schematic from the top.

2
  • 1
    So, tty actually reads from keyboard in a magical way, and writing anything to tty can only cause the display of messages. Mar 23, 2012 at 0:25
  • 2
    Less magic and more "inside the kernel", but yes.
    – Eroen
    Mar 23, 2012 at 8:20
5

Go to terminal A any type tty

you will get something like "/dev/pts/0"

Now, go to terminal B and type exec 0</dev/pts/0 (or whatever the tty command gave you)

Return to terminal A and commands you enter will run on terminal B.

2
  • 3
    Let me mention that this creates an interesting race condition, which on my system makes it seemingly random which shell gets a character.
    – Eroen
    Mar 22, 2012 at 16:05
  • Eoren, that sounds like there are two reader for one input who are compete for the data from the same stream.
    – Ray
    Jul 9, 2019 at 16:10
1

How to redirect to stdin of a running bash shell?

using C (https://stackoverflow.com/a/7370822. i have not tested it):

char* cmd="ls\n";
int fd = open (ptsname, O_RDWR);

while (*cmd)
{
    ioctl(fd, TIOCSTI, cmd++);
}

using Perl (https://unix.stackexchange.com/a/48221. works perfectly, but only for current shell):

require "sys/ioctl.ph";
ioctl(STDIN, &TIOCSTI, $_) for split "", join " ", @ARGV;
1
  • 1
    On superuser, we are talking about shell, not C or perl.
    – outoftime
    Apr 11, 2015 at 8:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .