linux-kernel - How can I parse the command name from /proc/<pid>/stat?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <fc15da367389.5480b999@langara.bc.ca>
Date:	Thu, 04 Dec 2014 19:44:25 +0000 (GMT)
From:	Steven Stewart-Gallus <sstewartgallus00@...angara.bc.ca>
To:	linux-kernel@...r.kernel.org
Subject: How can I parse the command name from /proc/<pid>/stat?

Hello,

Given an evil hacker trying to confuse process monitors that might use such
strange process names as 'pause) R 0 0 (foo' how can I correctly parse the
command name from /proc/<pid>/stat? Maybe I should just use /proc/<pid>/status?
Maybe there should be some documentation written on the issue? I just wanted to
send an email off to check if I was missing anything before writing a few small
additions to the documentation or filing a bug report. procps-ng seems to use an
ugly hack that involves knowing the limits on the size of a possible command
name that I'm not actually sure works totally correctly.

Thank you,
Steven Stewart-Gallus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/