Accessing a process structure in the processes link list

Accessing a process structure in the processes link list

[A M]

Would it be possible for a program running as root
that wasn't compiled with the kernel to access a
process structure in the processes link list? 

I've read an article about hiding processes and the
article made sound so easy to access the link list and
hide a process, how easy is it? 

Is it possible to a process to access its own entry in
the processes link list?


Thanks, 

Ali 




		
__________________________________ 
Do you Yahoo!? 
Meet the all-new My Yahoo! - Try it today! 
http://my.yahoo.com 
 

Re: Accessing a process structure in the processes link list

[Doug McNaught]

A M <alim1993@yahoo.com> writes:

> Would it be possible for a program running as root
> that wasn't compiled with the kernel to access a
> process structure in the processes link list? 

Yes, but see below.

> I've read an article about hiding processes and the
> article made sound so easy to access the link list and
> hide a process, how easy is it?

You need read access to /dev/kmem and a fairly intimate knowledge of
the kernel data structures in question.
 
> Is it possible to a process to access its own entry in
> the processes link list?

Not without read access to the kmem device...

-Doug

Re: Accessing a process structure in the processes link list

[A M]

How would you know the offset (location of index 0 if
it was an array or the head of link list) of that
variable in memory, in this case it is the process
table named task of type a pointer to task_struct? 

Any recommendation for references will be appreciated.


Thanks, 

Ali 

--- Doug McNaught <doug@mcnaught.org> wrote:

> A M <alim1993@yahoo.com> writes:
> 
> > Would it be possible for a program running as root
> > that wasn't compiled with the kernel to access a
> > process structure in the processes link list? 
> 
> Yes, but see below.
> 
> > I've read an article about hiding processes and
> the
> > article made sound so easy to access the link list
> and
> > hide a process, how easy is it?
> 
> You need read access to /dev/kmem and a fairly
> intimate knowledge of
> the kernel data structures in question.
>  
> > Is it possible to a process to access its own
> entry in
> > the processes link list?
> 
> Not without read access to the kmem device...
> 
> -Doug
> 



		
__________________________________ 
Do you Yahoo!? 
The all-new My Yahoo! - Get yours free! 
http://my.yahoo.com 
 

Re: Accessing a process structure in the processes link list

[Jim Nelson]

A M wrote:
> How would you know the offset (location of index 0 if
> it was an array or the head of link list) of that
> variable in memory, in this case it is the process
> table named task of type a pointer to task_struct? 
> 
> Any recommendation for references will be appreciated.
> 
> 
> Thanks, 
> 
> Ali 
> 

http://www.securityfocus.com/infocus/1811

is about identifying hooked syscalls, but the principles involved in locating the 
system call table could be applied to finding the process table.

P. S.  You can locate the process in memory with read access to /proc/kmem or 
/proc/mem (that's a lot tougher, though), but to modify it requires write access.


> --- Doug McNaught <doug@mcnaught.org> wrote:
> 
> 
>>A M <alim1993@yahoo.com> writes:
>>
>>
>>>Would it be possible for a program running as root
>>>that wasn't compiled with the kernel to access a
>>>process structure in the processes link list? 
>>
>>Yes, but see below.
>>
>>
>>>I've read an article about hiding processes and
>>
>>the
>>
>>>article made sound so easy to access the link list
>>
>>and
>>
>>>hide a process, how easy is it?
>>
>>You need read access to /dev/kmem and a fairly
>>intimate knowledge of
>>the kernel data structures in question.
>> 
>>
>>>Is it possible to a process to access its own
>>
>>entry in
>>
>>>the processes link list?
>>
>>Not without read access to the kmem device...
>>
>>-Doug
>>
> 
> 
> 
> 
> 		
> __________________________________ 
> Do you Yahoo!? 
> The all-new My Yahoo! - Get yours free! 
> http://my.yahoo.com 
>  
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 

Re: Accessing a process structure in the processes link list

[simon]

A M wrote:
> Would it be possible for a program running as root
> that wasn't compiled with the kernel to access a
> process structure in the processes link list? 
> 
> I've read an article about hiding processes and the
> article made sound so easy to access the link list and
> hide a process, how easy is it? 
there is some way... in kernel mode...
for example you can write a module who redirect the getdents system 
call... it is used to get directory listing...
command like ps are just a listing of the /proc/"pid" directories...
if you intercept a getdents call for a directory matching the pid of the 
process you want hide... just forget...
> 
> Is it possible to a process to access its own entry in
> the processes link list?
yes a process can change some attributes in his own entry... but i don't 
think it can acces to the process link list or hide itself in userspace...

simon