Theoreticly, if I know the pid of the bash shell which is running, I can run a cat whose stdout is redirected to the stdin of that shell. It seems to be as if I type something on that shell. Unfortunately, there WILL be stream coming from cat, BUT WILL NOT make the shell act properly (the entered command from cat will not be executed by bash).

Open a terminal:

ps -ef | grep bash
ymf       4906  4887  0 16:19 pts/0    00:00:00 /bin/bash

On another terminal:

cat 1> /proc/4906/fd/0
echo 'hello!'


  • 1
    Did you send the 'Return' key, too? As that would be needed to end a command. – boretom Mar 21 '12 at 9:24
  • @boretom Of course I did. – Determinant Mar 21 '12 at 9:34
  • Yes, I see, interesting question. The input to bash seems to be redirected to the stdout. Try running a command like top and you'll see that the stdin is just add somewhere to the output. My guess is that since the shell is started as an interactive shell it won't accept commands from stdin. But that's pure speculation. – boretom Mar 21 '12 at 9:43
  • While I'm no guru here, I think what you do is writing to the terminal emulator, and not to the process in question. IE you write to the right pipe junction, but it winds up in the wrong of the two pipes. – Eroen Mar 21 '12 at 9:47
  • @boretom try ls -l /proc/PID/fd/. 0, 1, 2 are all redirected to /dev/pts/TERM_NUMER No matter whether it accepts commands from stdin, I'm sure of that fd0 is for input and I've already redirect the output of cat to it. – Determinant Mar 22 '12 at 12:58

I'm tired of the "one paragraph only" limit in comments =)

If you start a shell sh, and get the pid $pid you can find the file descriptors as you describe. An example:

$ ls -l /proc/29201/fd
total 0
lrwx------ 1 eroen users 64 Mar 22 15:52 0 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 1 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 2 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 255 -> /dev/pts/2

You will notice that 1, 2 and 3 are all symlinks to the same tty (a chardev). In other words, the input to the process is read from the same device node as the outputs are written to.

When you attempt to write (in a different process) to the same tty (as either /proc/$pid/fd/0 or /dev/pts/? you accomplish exactly the same thing as the process itself does when it writes data to it's output; the data shows up in the terminal window.

Actually changing where fd[0-2] point after starting a process is fairly complicated, but not impossible. Reptyr is a free open source application that modifies an existing process so it's fd[0-2] point to a different tty (as well as some other stuff). This is accomplished through the ptrace framework. The post also mentions other softwares that do the same thing, and that it can be done through gdb.

Depending on what you actually wanted to accomplish, you might find Reptyr or some other software does what you need. Otherwise, you can look at/copy/modify the source code and find out how they do the trick.

This contains a few illustrating diagrams, in particular the third schematic from the top.

  • 1
    So, tty actually reads from keyboard in a magical way, and writing anything to tty can only cause the display of messages. – Determinant Mar 23 '12 at 0:25
  • 2
    Less magic and more "inside the kernel", but yes. – Eroen Mar 23 '12 at 8:20

Go to terminal A any type tty

you will get something like "/dev/pts/0"

Now, go to terminal B and type exec 0</dev/pts/0 (or whatever the tty command gave you)

Return to terminal A and commands you enter will run on terminal B.

  • 3
    Let me mention that this creates an interesting race condition, which on my system makes it seemingly random which shell gets a character. – Eroen Mar 22 '12 at 16:05
  • Eoren, that sounds like there are two reader for one input who are compete for the data from the same stream. – Ray Jul 9 at 16:10

How to redirect to stdin of a running bash shell?

using C (https://stackoverflow.com/a/7370822. i have not tested it):

char* cmd="ls\n";
int fd = open (ptsname, O_RDWR);

while (*cmd)
    ioctl(fd, TIOCSTI, cmd++);

using Perl (https://unix.stackexchange.com/a/48221. works perfectly, but only for current shell):

require "sys/ioctl.ph";
ioctl(STDIN, &TIOCSTI, $_) for split "", join " ", @ARGV;
  • 1
    On superuser, we are talking about shell, not C or perl. – outoftime Apr 11 '15 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.