Process table

[allanm77]

Hi All,

Is there a way I can run a command/script so that it does not show up in the ps command while running.

Avoid process table?

Thanks,

Allan.

[Torsten.]

I wonder if this would make any sense?

[James R. Ferguson]

Hi:

Are you asking how to hide something as in "security-by-obscurity" or are you asking how to best look at the process table but not find the process used to look (e.g. the classic use of 'grep' to find a process by name)?

Regards!

...JRF...

[allanm77]

Hi JRF!

Best would be that the process doesn't show up through ps command.

Security bu obscurity would work too if first one doesn't...

Thanks,
Allan.

[Matti_Kurkela]

As far as I understand, on HP-UX the ps output is produced by direct examination of the process table structure of the kernel. If the process is not listed in the kernel's table, it won't receive any CPU time and therefore won't be running (technically, it would not even exist as a real process). Regular users already have an option to see their own processes only in the ps listing, and root can always see everything.

Since it is possible for programs to edit their own command line as displayed in the ps listing (example: sendmail), it might be possible to embed some terminal control sequences that would cause the line to be deleted from a typical terminal/emulator, but that trick only works against one terminal type at a time, and is easily undone with "ps -ef | cat -v" anyway. If I saw a program trying to hide itself, I would consider it extremely suspicious and a possible indication of malicious intent.

What is the actual problem you're trying to solve by hiding a process?

[Dennis Handly]

>Is there a way I can run a command/script so that it does not show up in the ps command

If there is a process, it shows up.

>on HP-UX the ps output is produced by direct examination of the process table structure of the kernel.

Well, it comes from pstat(2).

>Since it is possible for programs to edit their own command line as displayed in the ps listing, it might be possible to embed some terminal control sequences

pstat(2) looks for those and suppresses them.