Many programs have counted on being able to overwrite command-line
arguments so that other information shows in `ps`. Linux Version 2.3.35
now prevents that from working. Is this a new <security feature> or
is it related to the kernel command-line bug already reported?
#include <stdio.h>
#include <unistd.h>
#include <wait.h>
int main(int args, char *argv[])
{
int st;
switch(fork())
{
case 0:
strcpy(argv[0], "0123456789ABCDEF");
sleep(1);
exit(0);
case -1:
exit(1);
default:
system("ps law");
wait(&st);
}
return 0;
}
Script started on Wed Jan 5 11:46:13 2000
# xxx 12345678
| 8 characters plus 3 for the executing file
FLAGS UID PID PPID PRI NI SIZE RSS WCHAN STA TTY TIME COMMAND
0 0 2087 2086 8 0 1180 764 wait4 S p0 0:00 bash -i
0 0 2091 2087 9 0 692 212 wait4 S p0 0:00 xxx 12345678
40 0 2092 2091 9 0 692 208 nanosleep S p0 0:00 0123456789ABC
|_ Command line was truncated
100000 0 2093 2091 10 0 980 488 R p0 0:00 ps law
# xxx
|______ No extra command-line space.
FLAGS UID PID PPID PRI NI SIZE RSS WCHAN STA TTY TIME COMMAND
0 0 2087 2086 14 0 1180 764 wait4 S p0 0:00 bash -i
0 0 2095 2087 18 0 692 212 wait4 S p0 0:00 xxx
40 0 2096 2095 17 0 692 208 nanosleep S p0 0:00 0123
|_Command line truncated
100000 0 2097 2095 19 0 980 488 R p0 0:00 ps law
# xxx .
||| lots of spaces |______ Should be enough.
FLAGS UID PID PPID PRI NI SIZE RSS WCHAN STA TTY TIME COMMAND
0 0 2087 2086 4 0 1180 764 wait4 S p0 0:00 bash -i
0 0 2099 2087 5 0 692 212 wait4 S p0 0:00 xxx .
|_ Was truncated.
40 0 2100 2099 5 0 692 208 nanosleep S p0 0:00 012345
|_Command line truncated
100000 0 2101 2099 5 0 980 488 R p0 0:00 ps law
# exit
exit
Script done on Wed Jan 5 11:46:46 2000
If this is a new security feature, it breaks a lot of network daemons.
Does anybody know an "approved" way of changing what `ps` shows, i.e.,
proc/NN/cmdline.
I have found that:
argv[0] = "new command";
argv[1] = "Next";
argv[2] = NULL;
... doesn't show! So /proc/NN/cmdline must have been written before
the program was exec'd.
Cheers,
Dick Johnson
Penguin : Linux version 2.3.35 on an i686 machine (400.59 BogoMips).
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Fri Jan 07 2000 - 21:00:04 EST