BUG: fork do not copy /proc/<PID>/cmdline permissions

BUG: fork do not copy /proc/<PID>/cmdline permissions

[Agri]

I expected from fork to make a rather complete copy of a process,
but it does not copy /proc/<PID>/cmdline access permissions.
Therefore, the only way (at least i know) to hide all args of
processes is to start every program within shell script:
bash -c 'chmod /proc/$$/cmdline; exec userprogramm ...'

Tested on 2.6.5.

Agri

Re: BUG: fork do not copy /proc/<PID>/cmdline permissions

[Richard B. Johnson]

On Thu, 22 Apr 2004, Agri wrote:

> I expected from fork to make a rather complete copy of a process,
> but it does not copy /proc/<PID>/cmdline access permissions.
> Therefore, the only way (at least i know) to hide all args of
> processes is to start every program within shell script:
> bash -c 'chmod /proc/$$/cmdline; exec userprogramm ...'
>
> Tested on 2.6.5.
>
> Agri

Huh? /proc/$PID/cmdline doesn't exist until after a task is
created. What you did was create a task, change whatever
is in proc, then exec (which doesn't change the PID).

How would you expect fork() to know that you wanted to
do this? The permissions in /proc are file permissions.
They have nothing to do with a task.

Also, any task can read its own command-line without using
/proc at all.

Cheers,
Dick Johnson
Penguin : Linux version 2.4.26 on an i686 machine (5557.45 BogoMips).
            Note 96.31% of all statistics are fiction.

Re: BUG: fork do not copy /proc/<PID>/cmdline permissions

[Agri]

On Thu, 22 Apr 2004 16:36:28 -0400 (EDT)
"Richard B. Johnson" <root@chaos.analogic.com> wrote:

> On Thu, 22 Apr 2004, Agri wrote:
> 
> > I expected from fork to make a rather complete copy of a process,
> > but it does not copy /proc/<PID>/cmdline access permissions.
> > Therefore, the only way (at least i know) to hide all args of
> > processes is to start every program within shell script:
> > bash -c 'chmod /proc/$$/cmdline; exec userprogramm ...'
> >
> > Tested on 2.6.5.
> >
> > Agri
> 
> Huh? /proc/$PID/cmdline doesn't exist until after a task is
> created. 
So setting all /proc/$PID/* file parameters should be a part of task creation.

> What you did was create a task, change whatever
> is in proc, then exec (which doesn't change the PID).
I know that. It solved my problem, but didn't fix the bug.
Any fork of a process reveals all its args.
Everybody have a right to be paranoid to hide everything, don't u think? :-)
Huh... Including number of processes. :-)

> 
> How would you expect fork() to know that you wanted to
> do this? The permissions in /proc are file permissions.
> They have nothing to do with a task.
> 
> Also, any task can read its own command-line without using
> /proc at all.
> 
> Cheers,
> Dick Johnson
> Penguin : Linux version 2.4.26 on an i686 machine (5557.45 BogoMips).
>             Note 96.31% of all statistics are fiction.
> 
> 
> 

Re: BUG: fork do not copy /proc/<PID>/cmdline permissions

[Richard B. Johnson]

On Fri, 23 Apr 2004, Agri wrote:

> On Thu, 22 Apr 2004 16:36:28 -0400 (EDT)
> "Richard B. Johnson" <root@chaos.analogic.com> wrote:
>
> > On Thu, 22 Apr 2004, Agri wrote:
> >
> > > I expected from fork to make a rather complete copy of a process,
> > > but it does not copy /proc/<PID>/cmdline access permissions.
> > > Therefore, the only way (at least i know) to hide all args of
> > > processes is to start every program within shell script:
> > > bash -c 'chmod /proc/$$/cmdline; exec userprogramm ...'
> > >
> > > Tested on 2.6.5.
> > >
> > > Agri
> >
> > Huh? /proc/$PID/cmdline doesn't exist until after a task is
> > created.
> So setting all /proc/$PID/* file parameters should be a part of task creation.
>

You didn't bother to read the line above nor the fact that /proc
has NOTHING TO DO WITH A PROCESS.

If you don't want to share information amongst tasks, you simply
execute `umount /proc` as root. Then nobody except root can see
anything about any other task if the home directories of other
tasks are not world readable.

Each task then becomes isolated in its own little cocoon.
[SNIPPED...]

Cheers,
Dick Johnson
Penguin : Linux version 2.4.26 on an i686 machine (5557.45 BogoMips).
            Note 96.31% of all statistics are fiction.