How can I parse the command name from /proc/<pid>/stat?

From: Steven Stewart-Gallus
Date: Thu Dec 04 2014 - 14:44:35 EST


Given an evil hacker trying to confuse process monitors that might use such
strange process names as 'pause) R 0 0 (foo' how can I correctly parse the
command name from /proc/<pid>/stat? Maybe I should just use /proc/<pid>/status?
Maybe there should be some documentation written on the issue? I just wanted to
send an email off to check if I was missing anything before writing a few small
additions to the documentation or filing a bug report. procps-ng seems to use an
ugly hack that involves knowing the limits on the size of a possible command
name that I'm not actually sure works totally correctly.

Thank you,
Steven Stewart-Gallus
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at