False positive when process started by running a symlink to the binary

[Luis Bruno]

Check PID 3379: I think this is related to the process having been launched froma symlink.

The PID 4606 problem looks to be a race condition with the pre-forked children and I'll try to characterize it later.

Thanks!
--lbruno

10:21:54 root@lithium:~> ls -l "/usr/sbin/apache2"
lrwxrwxrwx 1 root root 30 Dec 30 2010 /usr/sbin/apache2 -> ../lib/apache2/mpm-itk/apache2

10:33:35 root@lithium:~> unhide.rb
Scanning for hidden processes...
Suspicious PID 3379:
  Seen by ps ("/usr/sbin/apache2")
  Seen by /proc tasks ("/usr/lib/apache2/mpm-itk/apache2")
  Not seen by getsid()
  Not seen by getpgid()
  Not seen by getpriority()
  Not seen by sched_getparam()
  Not seen by sched_getaffinity()
  Not seen by sched_getscheduler()
  Not seen by sched_rr_get_interval()
Suspicious PID 4606:
  Not seen by ps
  Seen by /proc ("/usr/lib/apache2/mpm-itk/apache2")
  Seen by getsid()
  Seen by getpgid()
  Seen by getpriority()
  Seen by sched_getparam()
  Seen by sched_getaffinity()
  Seen by sched_getscheduler()
  Seen by sched_rr_get_interval()

10:34:42 root@lithium:~>

[Johan Walles (walles)]

Hi!

Both of these issues are because unhide.rb is racing with process shutdown (3379) and startup (4606). Symlinks have nothing to do with this.

I just committed a fix for this:
http://bazaar.launchpad.net/~walles/unhide.rb/trunk/revision/13

The fix is to check suspicious processes again. If they don't trigger any warning the second time around they aren't listed.

Also, I fixed a discrepancy between the docs and the actual behavior. All warnings are now printed on stderr.

  Regards //Johan

[Luis Bruno (d-it)]

Thanks, this problem hasn't happened anymore! Sorry for having mislead you.
Kind regards, --lbruno