A security related exercise:
For extra security, I have traditional Unix accounting (acct
) turned on. This can help investigate suspicious activity after the fact.
According to the man page /var/log/account
is a directory containing pacct
(process accounting) files which contain process accounting data as written by the kernel, presumably for every process that exit
ed while accounting was active. Command names are truncated to 15-chars (this seems to be a little bug: man 5 acct
shows #define ACCT_COMM 16
not including the additional char for the terminating NULL in the struct, but I see a max of 15 chars rather than 16).
When I run lastcomm
which converts the most recent pacct
file to human-readable form, I get some lines where the 1st (leftmost) column is not an obvious command (name of an on-disk executable file) even when I ignore chars beyond the 15-char limit. Here are some examples:
kworker/dying
handle-watcher-
WorkerPool/28
ScriptStreamerT
Compositor
CompositorTileW
Chrome_ChildIOT
Some of these look like names of kernel threads. There are many more threads I can see running (e.g. in top
) that do not appear in this list. I assume the missing ones are long running processes that never exit
ed since acct
was enabled.
Question: Can someone explain what each of the above unaccounted for processes are?
For reference, here is the bash script to list the commands that weren't found on disk, so you may run it yourself (make sure to run sudo updatedb
first)
#!/bin/bash
fullpath_of_cmd() {
# cmd may be truncated to a max of 15 chars (see "man 5 acct")
cmd="$1"
# Search for any file matching this prefix
# (assumes locate db is up to date)
paths=$(locate "/$cmd")
echo "$paths"
}
for cmd in $(lastcomm | cut -d' ' -f1 | sort -u); do
# echo === $cmd
paths=$(fullpath_of_cmd "$cmd")
case "$paths" in
(*/$cmd*) : cool, found it ;;
(*) printf "%s -> NOT FOUND (%s)\n" $cmd $paths ;;
esac
done