topic Process table in Operating System - HP-UX

Process table

allanm77 — Fri, 04 Nov 2011 06:22:49 GMT

Hi All,

Is there a way I can run a command/script so that it does not show up in the ps command while running.

Avoid process table?

Thanks,

Allan.

Re: Process table

Torsten. — Fri, 04 Nov 2011 07:30:12 GMT

I wonder if this would make any sense?

Re: Process table

James R. Ferguson — Fri, 04 Nov 2011 12:37:57 GMT

Hi:

Are you asking how to hide something as in "security-by-obscurity" or are you asking how to best look at the process table but not find the process used to look (e.g. the classic use of 'grep' to find a process by name)?

Regards!

...JRF...

Re: Process table

allanm77 — Fri, 04 Nov 2011 18:14:37 GMT

Hi JRF!

Best would be that the process doesn't show up through ps command.

Security bu obscurity would work too if first one doesn't...

Thanks,
Allan.

Re: Process table

Matti_Kurkela — Sat, 05 Nov 2011 09:58:25 GMT

As far as I understand, on HP-UX the ps output is produced by direct examination of the process table structure of the kernel. If the process is not listed in the kernel's table, it won't receive any CPU time and therefore won't be running (technically, it would not even exist as a real process). Regular users already have an option to see their own processes only in the ps listing, and root can always see everything.

Since it is possible for programs to edit their own command line as displayed in the ps listing (example: sendmail), it might be possible to embed some terminal control sequences that would cause the line to be deleted from a typical terminal/emulator, but that trick only works against one terminal type at a time, and is easily undone with "ps -ef | cat -v" anyway. If I saw a program trying to hide itself, I would consider it extremely suspicious and a possible indication of malicious intent.

What is the actual problem you're trying to solve by hiding a process?

Re: Process table, hiding

Dennis Handly — Sun, 06 Nov 2011 20:44:56 GMT

>Is there a way I can run a command/script so that it does not show up in the ps command

If there is a process, it shows up.

>on HP-UX the ps output is produced by direct examination of the process table structure of the kernel.

Well, it comes from pstat(2).

>Since it is possible for programs to edit their own command line as displayed in the ps listing, it might be possible to embed some terminal control sequences

pstat(2) looks for those and suppresses them.