19

How could you launch a process and make it invisible to the top command? The process is started by a normal user (not root), and should not be visible to other normal users.

Gilles 'SO- stop being evil'
  • 829,060
Debugger
  • 437
  • 1
    That kind of defeats the purpose of top and would be far too easy to abuse. Why not simply rename the process? this_is_not_the_process_you_are_looking_for? –  Jul 21 '11 at 19:13
  • i see, what about hiding the user ? –  Jul 21 '11 at 19:47
  • 5
    Please tell us you're not trying to write a root-kit. Can you explain your scenario so that perhaps we can suggest a better security architecture instead of one that is generally considered "evil" behavior? – Caleb Jul 21 '11 at 20:30
  • 3
    You can use grsecurity or SELinux. Both require root intervention for the initial setup. – Gilles 'SO- stop being evil' Jul 21 '11 at 20:43

6 Answers6

15

Linux kernel since 3.3 contains support for hiding processes to other users.

It is done by hidepid= and gid= mount options for /proc as described in the corresponding commit and Documentation/filesystems/proc.txt.

Debian Wheezy also includes this feature.

user1338062
  • 613
jofel
  • 26,758
11

The top command reads the data from proc, which is provided directly from the kernel. In order to hide processes, you'd have to use code inside the kernel to do the masking.

Aside from using a security framework like SELinux and grsecurity (mentioned in the other answers), rootkit-style code is your only remaining option. I say "style" because a "rootkit" by itself isn't bad, it's how it's used. There are perfectly legitimate reasons behind hiding processes from other users, which is why this capability exists in security frameworks.

The basic route you'd have to follow to get this to work is to hook into (or hijack, depending on how you look at it) the function(s) in the linux kernel that hand out the /proc/pid/ data. I demonstrate one method of hooking into linux kernel functions in a security module I wrote:

https://github.com/cormander/tpe-lkm

The "high level" code for this is in the hijack_syscalls() method in security.c, and the devil-in-the-details magic behind it is in the hijacks.c file.

You'll likely find the function(s) you'll want to hook into in the fs/proc/ directory of the source code of the linux kernel. Keep in mind that linux does not provide a stable ABI, so your code will need to change somewhat in order to get it working in different versions of the linux kernel. Also, keep in mind that you need full root access to the machine to be able to insert this code.

UPDATE:

If you wrap the pid_getattr kernel symbol with some additional code to it's real easy to do this. I recently added something that hides processes to the above kernel module:

https://github.com/cormander/tpe-lkm/commit/899bd5d74764af343d5fee1d8058756ddc63bfe3

You could do something similar by making the processes of a certain user or group not viewable by anyone except root and that user. Doing it by process name is a bit more complex, but possible. Have a look at the exe_from_mm() function. Note that there may be performance implications of using it inside of pid_getattr.

Corey Henderson
  • 801
5

It seems the two main options.

  • Selinux works by putting different people into different security domains and in a sense sand-boxing them so they can't see each-others stuff. This is covered in this question. Since selinux is quickly becoming the de-facto security framework in the Linux world this is probably the direction you should look.

  • The other is grsecurity as mentioned by marioosh and as asked in this question. Some distros have alternative kernel packages with grsecurity patches applied. If yours has this you might look into using them.

If for some reason you want to do this without the addition of a security framework like selinux or grsecurity, please explain how what you are doing is not writing a root-kit.

Community
  • 1
Caleb
  • 70,105
1

It is not so simple on standard linux box. Look at the grsecurity, but it requires patching kernel etc.

marioosh
  • 119
1

you could override your argv[0] with another name... but strictely speaking, you're looking for some kind of rootkit. this may help you out: http://stupefydeveloper.blogspot.com/2008/10/linux-change-process-name.html

marcelog
  • 111
0

You could write an equivalent command that works just like top, but doesn't display processes matching a specific name. Alternatively you can get the source code of the top command and modify it accordingly. You can then replace the top command in /usr/sbin (or wherever it is) with your version.

LawrenceC
  • 10,992