0

A security related exercise: For extra security, I have traditional Unix accounting (acct) turned on. This can help investigate suspicious activity after the fact.

According to the man page /var/log/account is a directory containing pacct (process accounting) files which contain process accounting data as written by the kernel, presumably for every process that exited while accounting was active. Command names are truncated to 15-chars (this seems to be a little bug: man 5 acct shows #define ACCT_COMM 16 not including the additional char for the terminating NULL in the struct, but I see a max of 15 chars rather than 16).

When I run lastcomm which converts the most recent pacct file to human-readable form, I get some lines where the 1st (leftmost) column is not an obvious command (name of an on-disk executable file) even when I ignore chars beyond the 15-char limit. Here are some examples:

kworker/dying
handle-watcher-
WorkerPool/28
ScriptStreamerT
Compositor
CompositorTileW
Chrome_ChildIOT

Some of these look like names of kernel threads. There are many more threads I can see running (e.g. in top) that do not appear in this list. I assume the missing ones are long running processes that never exited since acct was enabled.

Question: Can someone explain what each of the above unaccounted for processes are?

For reference, here is the bash script to list the commands that weren't found on disk, so you may run it yourself (make sure to run sudo updatedb first)

#!/bin/bash

fullpath_of_cmd() {
    # cmd may be truncated to a max of 15 chars (see "man 5 acct")
    cmd="$1"
    # Search for any file matching this prefix
    # (assumes locate db is up to date)
    paths=$(locate "/$cmd")
    echo "$paths"
}

for cmd in $(lastcomm | cut -d' ' -f1 | sort -u); do
    # echo === $cmd
    paths=$(fullpath_of_cmd "$cmd")
    case "$paths" in
        (*/$cmd*) : cool, found it ;;
        (*) printf "%s -> NOT FOUND (%s)\n" $cmd $paths ;;
    esac
done

1 Answer 1

1

The comm field doesn't necessarily correspond to the executable name; it is freely settable by the program itself, by writing to /proc/self/comm on Linux or by using some arcane prctl()'s.

On Linux, however, the accounting log seems to include not only processes but also userspace threads. (Linux processes and threads are very nearly the same, after all.) The examples given look exactly like thread names that Chromium or perhaps some other WebKit/Blink-based browser would use.

To see them yourself, run htop, press F2, under "Display options" enable the following:

  • [✔] Show custom thread names
  • [✔] Display threads in a different color

Press Shift+H to toggle userspace threads; Shift+K for kernel threads.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .