Re: Invisible threads in 2.6.9

[Michal Schmidt <xschmi00@stud.feec.vutbr.cz>]

Nuno Silva wrote:
> Yes, that's the new method trojans are using to hide tasks... No need to 
> install complicated kernel modules anymore :-)
> 
> More seriously: That's a problem with current procps utils... They just 
> don't show them. I can't complain too much because I'm not doing any 
> code, but it would be nice to have a working top...
> 
> As a workaround, to at least see the threads without inspecting /proc 
> directly, you can use the 'm' and 'H' flags to ps, i.e.
> 
> $ ps auwxH
> 

It doesn't work for me:

# ps aux | grep [t]hread
michich   7447  0.0  0.0     0    0 pts/1    Zl+  09:43   0:00 [threadbug] <defunct>
# ps auwxH | grep [t]hread
#

And I can't inspect /proc directly:
# cd /proc/7447
# ls -l
ls: cannot read symbolic link cwd: No such file or directory
ls: cannot read symbolic link root: No such file or directory
ls: cannot read symbolic link exe: No such file or directory
total 0
dr-xr-xr-x  2 root root 0 Oct  6 09:48 attr
-r--------  1 root root 0 Oct  6 09:48 auxv
-r--r--r--  1 root root 0 Oct  6 09:44 cmdline
lrwxrwxrwx  1 root root 0 Oct  6 09:48 cwd
-r--------  1 root root 0 Oct  6 09:48 environ
lrwxrwxrwx  1 root root 0 Oct  6 09:48 exe
dr-x------  2 root root 0 Oct  6 09:44 fd
-r--r--r--  1 root root 0 Oct  6 09:48 maps
-rw-------  1 root root 0 Oct  6 09:48 mem
-r--r--r--  1 root root 0 Oct  6 09:48 mounts
lrwxrwxrwx  1 root root 0 Oct  6 09:48 root
-r--r--r--  1 root root 0 Oct  6 09:44 stat
-r--r--r--  1 root root 0 Oct  6 09:48 statm
-r--r--r--  1 root root 0 Oct  6 09:44 status
dr-xr-xr-x  3 root root 0 Oct  6 09:45 task
-r--r--r--  1 root root 0 Oct  6 09:48 wchan
# cd task
bash: cd: task: No such file or directory
# ls -l task
ls: task: No such file or directory
# ls -l | grep task
ls: cannot read symbolic link cwd: No such file or directory
ls: cannot read symbolic link root: No such file or directory
ls: cannot read symbolic link exe: No such file or directory
dr-xr-xr-x  3 root root 0 Oct  6 09:45 task

Isn't it strange?

Michal Schmidt