15

First, I presume that if this is possible it would need to be done as root (or as a user who shares root's UID of 0).

How can a process be launched so that it does not show up in a ps aux or ps ef or top listing if the command is run by non-root?

Is this even possible?

The distributions I typically run are RHEL/CentOS and Ubuntu - so if there is a distro-specific answer, that's ok, too.

4
  • warren: Ever find a solution to this?
    – Chris
    Nov 15, 2010 at 14:41
  • @Chris - nope... @fianchetto's answer seems to be the only route, and that's a lot more work than I'm comfortable undertaking :-|
    – warren
    Nov 15, 2010 at 15:59
  • I am going to undertake this project and will report back with anything I determine.
    – Chris
    Nov 15, 2010 at 17:32
  • @Chris - did you ever find a solution to this question?
    – warren
    Aug 9, 2022 at 13:11

4 Answers 4

6

Well, you have a couple of options here. Taking the easy way out would be to swap the ps and top programs out with modified versions that hide what it is you want to hide.

The alternative would be to run your code embedded in an existing process, or write a wrapper-script around your code with an innocuous name.

In some versions of PS, you can modify it by changing argv[], but not sure if that works for top, and not sure if it works in linux (It's mainly a BSD convention).

It all depends, on exactly what you are looking to achieve by doing this?

3
  • my goal here is for processes spawned by root to not be visible to all users (perhaps security-related daemons or similar)
    – warren
    Oct 13, 2010 at 19:20
  • @flanchetto So, are you saying if I have a program that is already running and it later runs a command-line command with a password in it in the same process that the password will be securely given? e.g. run python myScript.py and all the subprocess.Popen commands (which may or may not contain passwords) are not shown, as long as it's the same process? Feb 11, 2016 at 11:43
  • 1
    Anyway, that doesn't work (I just tried it and saw the password). So, I'm assuming you mean something else. Feel free to clarify. :) Feb 11, 2016 at 12:00
16

According to kernel patch http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=0499680a42141d86417a8fbaa8c8db806bea1201, you can use the hidepid option for the proc filesystem:

hidepid=0 (default) means the old behavior - anybody may read all world-readable /proc/PID/* files.

hidepid=1 means users may not access any /proc// directories, but their own. Sensitive files like cmdline, sched*, status are now protected against other users. As permission checking done in proc_pid_permission() and files' permissions are left untouched, programs expecting specific files' modes are not confused.

hidepid=2 means hidepid=1 plus all /proc/PID/ will be invisible to other users. It doesn't mean that it hides whether a process exists (it can be learned by other means, e.g. by kill -0 $PID), but it hides process' euid and egid. It compicates intruder's task of gathering info about running processes, whether some daemon runs with elevated privileges, whether another user runs some sensitive program, whether other users run any program at all, etc.

gid=XXX defines a group that will be able to gather all processes' info (as in hidepid=0 mode). This group should be used instead of putting nonroot user in sudoers file or something. However, untrusted users (like daemons, etc.) which are not supposed to monitor the tasks in the whole system should not be added to the group.

You are not able to control the visibility on process level however you can ensure that your users can see their own processes only.

In case you have kernel version greater than 3.3 you can make a try with the following command:

 
mount /proc -o remount,hidepid=2

5
  • Can you limit the hidepid=2 thing so it only affects specific users (or so it whitelists certain users)? Feb 11, 2016 at 11:46
  • Works great! My problem was that I'm connecting to a server using a cron script and any user was able to see the credentials using "htop" (for example). Setting to "hidepid=2" users can not see processes launched by other users which is what I was looking for. Why is not set by default?
    – lepe
    Jul 1, 2016 at 0:51
  • @lepe probably for legacy reasons. Would break this and that and therefore can't (yet) be used everywhere. Jan 9, 2017 at 14:42
  • OP asked for the pid to be invisible in overall, not just to other users ...?
    – phil294
    May 26, 2017 at 3:20
  • Is there a way to hide processes created by certain users only? eg. root?
    – Avery235
    Mar 31, 2018 at 7:16
6

The option described in this link worked for me. In that link, the author is hiding a process called evil_script.py.

I'm pasting the content here just in case the link goes down:

  1. First, create a file named processhider.c with the content found in this link: processhider.c

  2. Compile the code with:

    gcc -Wall -fPIC -shared -o libprocesshider.so processhider.c -ldl

  3. Move the library with:

    sudo mv libprocesshider.so /usr/local/lib/

  4. Tell the dynamic linker to use it:

    echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload

That is it. If you now run ps faux you won't see any process called evil_script.py.

-2

use the F command in top and n command, for example to configure what you want to see. use the W command to write the config you like to ~/.toprc -- use ? to see top commands. This may solve your problem quickly - it did for me. With F i can add/remove the fields I want to see, while in f can use s to set the sort, then q to go back to display. then n to set how many processes i want to see and W to save to .toprc

1
  • That only hides something in my view
    – warren
    Dec 11, 2016 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .