🚀 go-pugleaf

Alan J Rosenthal (flaps@dgp.toronto.edu) wrote:
: sxjcb@orca.alaska.edu (Jay C. Beavers) writes:
: >I've recently heard that you can hide a process from being displayed by a
: >ps -ax command.  Is this true, and if so what security implications does it
: >have?  How is this done,
: 
: #include <stdio.h>
: #include <string.h>
: 
: int main(argc, argv)
:     int argc;
:     char **argv;
: {
:     char *p;
: 
:     for (p = argv[0]; *p; p++)
: 	*p = 0;
:     strcpy(argv[0], "rn");
: 
:     (void)getchar();  /* to allow you to see that ps reports "rn" */
:     return(0);
: }


This might be a simple way to do it,  if it worked!  On some systems
it will do the trick (e.g. SunOS),  but it doesn't work on IBM's
running AIX (well,  v3.1.5 at least,  'cause I tried it).  In any case,
all that changes is the program name (you could do as good as that by
changing the name of the program before you ran it!).  All the other 
info is still listed as normal,  which doesn't really satisfy the
original question.  Anyone know the real answer?

--
David Abbott                | Email: dfa@rabbit.physiol.unimelb.edu.au
School of Physics & Dept. of Physiology | Phone: +61-3-344-5465
The University of Melbourne, Australia. | Fax:    Available on request.