How to redirect to stdin of a running bash shell?

All we need is an easy explanation of the problem, so here it is.

Theoreticly, if I know the pid of the bash shell which is running, I can run a cat whose stdout is redirected to the stdin of that shell. It seems to be as if I type something on that shell. Unfortunately, there WILL be stream coming from cat, BUT WILL NOT make the shell act properly (the entered command from cat will not be executed by bash).

Open a terminal:

ps -ef | grep bash
ymf       4906  4887  0 16:19 pts/0    00:00:00 /bin/bash

On another terminal:

cat 1> /proc/4906/fd/0
echo 'hello!'


How to solve :

I know you bored from this bug, So we are here to help you! Take a deep breath and look at the explanation of your problem. We have many solutions to this problem, But we recommend you to use the first method because it is tested & true method that will 100% work for you.

Method 1

I’m tired of the “one paragraph only” limit in comments =)

If you start a shell sh, and get the pid $pid you can find the file descriptors as you describe. An example:

$ ls -l /proc/29201/fd
total 0
lrwx------ 1 eroen users 64 Mar 22 15:52 0 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 1 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 2 -> /dev/pts/2
lrwx------ 1 eroen users 64 Mar 22 15:52 255 -> /dev/pts/2

You will notice that 1, 2 and 3 are all symlinks to the same tty (a chardev). In other words, the input to the process is read from the same device node as the outputs are written to.

When you attempt to write (in a different process) to the same tty (as either /proc/$pid/fd/0 or /dev/pts/? you accomplish exactly the same thing as the process itself does when it writes data to it’s output; the data shows up in the terminal window.

Actually changing where fd[0-2] point after starting a process is fairly complicated, but not impossible. Reptyr is a free open source application that modifies an existing process so it’s fd[0-2] point to a different tty (as well as some other stuff). This is accomplished through the ptrace framework. The post also mentions other softwares that do the same thing, and that it can be done through gdb.

Depending on what you actually wanted to accomplish, you might find Reptyr or some other software does what you need. Otherwise, you can look at/copy/modify the source code and find out how they do the trick.

This contains a few illustrating diagrams, in particular the third schematic from the top.

Method 2

Go to terminal A any type tty

you will get something like “/dev/pts/0”

Now, go to terminal B and type exec 0</dev/pts/0 (or whatever the tty command gave you)

Return to terminal A and commands you enter will run on terminal B.

Method 3

How to redirect to stdin of a running bash shell?

using C ( i have not tested it):

char* cmd="ls\n";
int fd = open (ptsname, O_RDWR);

while (*cmd)
    ioctl(fd, TIOCSTI, cmd++);

using Perl ( works perfectly, but only for current shell):

require "sys/";
ioctl(STDIN, &TIOCSTI, $_) for split "", join " ", @ARGV;

Note: Use and implement method 1 because this method fully tested our system.
Thank you 🙂

All methods was sourced from or, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

Leave a Reply