Article View: comp.security.misc
Article #331Re: Hiding Processes from ps -ax
From: Alan J Rosenthal
Date: Fri, 11 Sep 1992 04:48
Date: Fri, 11 Sep 1992 04:48
49 lines
2568 bytes
2568 bytes
avalon@coombs.anu.edu.au (Darren Reed) writes: >Some people reported that "ps" showed "rn ut". I never saw those articles; on what system does it do this??!??!? That is, if you zero out the rest of the name as my article said. This would be extremely bizarre behaviour and I'm quite sceptical that it exists. >Here, it shows "rn (a.out)". >eg, I commonly have this: >18570 p8 I 0:01 -tcsh (tcsh) This is not the same situation. Did my program actually show "rn (a.out)" or are you extrapolating? On what OS? There is a kludge in ps for when the argv[0] begins with a minus sign. On SunOS 4.1.1 at least, it also seems to be triggered by having a completely empty name, as you create later. Neither of these are methods I suggested because neither of them achieves the desired results. >However, if you can get the pid of a process then you can also >get the inode number of it too Processes don't have inode numbers. Files have inode numbers. >and if you have a decent OS, it shouldnt let you delete it while its running >(SunOS allows you to unlink running processes :-/). If you have a decent OS, it shouldn't try to second-guess you to death. Unix has always (well for a very, very long time at least) permitted you to unlink files which are currently being executed, and to kill processes. Neither of these is an undesirable feature; the second is essential; if you don't like the first, just don't invoke it. >Just now I tried the following: > for (s = argv; *s; s++) > for (t = *s; *t;) > *t++ = '\0'; > pause(); Yes, as I originally posted, this is not useful. And to continue the confusion, gay@moebius.loria.fr (Gay Stephane) writes: >ok, name is changed. but you can have the real name using ps -axc. >still waiting for *the* solution. *The* solution to hiding names from ps -ax? As I posted. Some other solution? I guess it depends on to which problem. If you want to change the name that ps -axc reports, change the name of the program before executing it. Using symlinks may help but this is not an essential component.
Technical Details
Message-ID:
<1992Sep11.004815.23118@jarvis.csri.toronto.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!usc!rpi!utcsri!dgp.toronto.edu!flapsReferences:
<sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!usc!rpi!utcsri!dgp.toronto.edu!flaps Newsgroups: comp.security.misc From: flaps@dgp.toronto.edu (Alan J Rosenthal) Subject: Re: Hiding Processes from ps -ax Message-ID: <1992Sep11.004815.23118@jarvis.csri.toronto.edu> References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr> Date: 11 Sep 92 04:48:16 GMT Lines: 49