[...] > >ISTR that sendmail has a function called > setproctitle() or somesuch; that > >will re-create the commands args, which /usr/ucb/ps > auxw will see _if_ > >one is the same euid as the process (or root), so > that one has permission > >to read the address space; otherwise one only sees > the saved 80 characters > >as of the latest exec in that process, which is also > what /usr/bin/ps -f > >shows. > > If we want to make an interface, then setproctitle is > the interface we > should emulate. > > >There is no facility for resetting u_psargs or > pr_psargs, as far as I know. > >Notwithstanding that it might be pretty and/or > informative to do so, > >it might also be used for evil purposes, i.e. some > nasty program trying > >to pretend it is something innocent. Therefore, IMO > it's better that > >the more common (and unprivileged) view of a > process's "name" can't > >readily be altered by that process. > > Who cares about the name? There's still > /proc/*/a.out and /proc/*/path/ > a.out; you can't change those. > > Casper
If something like setproctitle(), but also updating pr_psargs (and therefore u_psargs), were a new OS interface, I'd at least want it to set a new flag in psinfo indicating that it had been used, so that ps and friends could choose to also report the basename of what the corresponding /proc/*/path/a.out pointed to, as in [real_cmd] altered command line and also that it not affect auditing (except that the new setproctitle() call itself might also be audited). Changing the reporting of command lines that hadn't been altered might be construed to be incompatible behavior by some, but I think an altered command line is fair game. Altering command line arguments may not be all that effective if done for fraudulent purposes, but a lot of fraud only has to be effective enough to fool the average person; it doesn't have to be undetectable to be exploitable. -- This message posted from opensolaris.org _______________________________________________ opensolaris-code mailing list [email protected] http://mail.opensolaris.org/mailman/listinfo/opensolaris-code
