Tuesday, July 10, 2007

Re: [BLUG] spoofed process names?

Wow, easier than I expected. Fortunately you can still find out what
the actual process is called by grepping out the Name: line in /proc/[pid]/status


On Tue, Jul 10, 2007 at 12:34:51PM GMT, Brian Wheeler [bdwheele@indiana.edu] said the following:
>
> Nah, its "normal". Consider this perl program:
>
> #!/usr/bin/perl
> $0="hello there!";
> sleep 1000;
>

--
Mark Krenz
Bloomington Linux Users Group
http://www.bloomingtonlinux.org/
_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

Re: [BLUG] spoofed process names?

On Tue, 2007-07-10 at 11:55 +0000, ben lipkowitz wrote:
> recently i was poking around on a shared mainframe and saw that a user was
> running a rather interesting process:
>
> nullogic q8 - Mon06PM 11:57 Hey, I dont look at you...
>
> where normally it would look something like this:
> fenn rc - Mon07PM 0 (pine)
>
> any ideas on how this might have been accomplished?
> hint: sometimes i can get "w" to say "... (zsh)" at the end.
> this is a NetBSD system btw
>
> curiouser and curouser
>

Nah, its "normal". Consider this perl program:

#!/usr/bin/perl
$0="hello there!";
sleep 1000;

run it and then do a ps -ef:

bdwheele 31578 31505 0 08:31 pts/6 00:00:00 hello there!

>From the perlvar manpage, there's a description of what's going on:

$PROGRAM_NAME
$0 Contains the name of the program being executed.

On some (read: not all) operating systems assigning to $0 modi-
fies the argument area that the "ps" program sees. On some
platforms you may have to use special "ps" options or a differ-
ent "ps" to see the changes. Modifying the $0 is more useful
as a way of indicating the current program state than it is for
hiding the program you're running. (Mnemonic: same as sh and
ksh.)

Note that there are platform specific limitations on the maxi-
mum length of $0. In the most extreme case it may be limited
to the space occupied by the original $0.

In some platforms there may be arbitrary amount of padding, for
example space characters, after the modified name as shown by
"ps". In some platforms this padding may extend all the way to
the original length of the argument area, no matter what you do
(this is the case for example with Linux 2.2).

Note for BSD users: setting $0 does not completely remove
"perl" from the ps(1) output. For example, setting $0 to "foo-
bar" may result in "perl: foobar (perl)" (whether both the
"perl: " prefix and the " (perl)" suffix are shown depends on
your exact BSD variant and version). This is an operating sys-
tem feature, Perl cannot help it.

In multithreaded scripts Perl coordinates the threads so that
any thread may modify its copy of the $0 and the change becomes
visible to ps(1) (assuming the operating system plays along).
Note that the view of $0 the other threads have will not change
since they have their own copies of it.


Brian

> /\-/\
> >( o.o )<
> _____> <________fenn_____
> _______________________________________________
> BLUG mailing list
> BLUG@linuxfan.com
> http://mailman.cs.indiana.edu/mailman/listinfo/blug

_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

Re: [BLUG] spoofed process names?

I know that the mysql client (in the 3.x series) used to have a way of
removing the password argument from showing up in the process list. I
always wondered how they do that. I think I tried it again recently and
it doesn't do that anymore. Maybe something has changed in Linux that
prevents it now (which I think is the right thing to do).

It could be that the system you logged into itself has some kind of
process table viewing protection. There are some patches for Linux that
make it so that you can't view other user's processes. But that's
different from what you are asking about.


On Tue, Jul 10, 2007 at 11:55:52AM GMT, ben lipkowitz
[fenn@sdf.lonestar.org] said the following:
> recently i was poking around on a shared mainframe and saw that a user
> was running a rather interesting process:
>
> nullogic q8 - Mon06PM 11:57 Hey, I dont look at you...
>
> where normally it would look something like this: fenn rc -
> Mon07PM 0 (pine)
>
> any ideas on how this might have been accomplished? hint: sometimes i
> can get "w" to say "... (zsh)" at the end. this is a NetBSD system
> btw
>
> curiouser and curouser
>
> /\-/\
> >( o.o )<
> _____> <________fenn_____
> _______________________________________________ BLUG mailing list
> BLUG@linuxfan.com http://mailman.cs.indiana.edu/mailman/listinfo/blug
>

--
Mark Krenz
Bloomington Linux Users Group
http://www.bloomingtonlinux.org/
_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

[BLUG] spoofed process names?

recently i was poking around on a shared mainframe and saw that a user was
running a rather interesting process:

nullogic q8 - Mon06PM 11:57 Hey, I dont look at you...

where normally it would look something like this:
fenn rc - Mon07PM 0 (pine)

any ideas on how this might have been accomplished?
hint: sometimes i can get "w" to say "... (zsh)" at the end.
this is a NetBSD system btw

curiouser and curouser

/\-/\
>( o.o )<
_____> <________fenn_____
_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

Saturday, July 7, 2007

Re: [BLUG] Canceling gaming sessions

At 2200 on Saturday I'm still at work. End of story.
After this summer will be a different story, but for a
while I can't game at that hour, not till midnightish.
-adam nuwer



____________________________________________________________________________________
Need a vacation? Get great deals
to amazing places on Yahoo! Travel.
http://travel.yahoo.com/
_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

Re: [BLUG] Canceling gaming sessions

I'm sorry to hear it, but not too surprised.

I myself was one who was excited about this, and kept saying so, but
reality kept coming up with reason after reason not to show up.

If me from ten years ago would hear me talk about priorities in the
face of playing video games, he would surely smite me, and I would
probably deserve it.

Sorry.

Simón

On 7/6/07, Mark Krenz <mark@slugbug.org> wrote:
>
> I'm not going to be hosting the weekly gaming sessions anymore. At
> least for now. Nobody was showing up, and I don't see the point of
> putting time into something that nobody else is going to participate in.
>
> Granted, there have been a few people (Thank you Chris and Scott), but
> not the consistency I hoped for. I was hoping to have at least 4 people
> each week. Appearently survey results don't reflect reality. ;-)
>
> If someone else wants to pick it up, be my guest.
>
>
> --
> Mark Krenz
> Bloomington Linux Users Group
> http://www.bloomingtonlinux.org/
> _______________________________________________
> BLUG mailing list
> BLUG@linuxfan.com
> http://mailman.cs.indiana.edu/mailman/listinfo/blug
>


--
-Simón A. Ruiz

_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

Re: [BLUG] Question about yum in RHEL5

Thank you very much, Ben. That's exactly what we are looking for.
--Bruce

> try this:
> yum --disablerepo=* --enablerepo=csci-local -y install \*

_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug