Process with no name

[DAP]

Binary package hint: gnome-system-monitor

This probably has nothing to do with system monitor, but that is where I see the problem.
I have one process that has no name, its process ID keeps incrementing (about 100/second) hovering over the process name gives a tiny yellow box with no text in it. I can't kill it because its process ID changes too fast.
I'm going to reboot my computer now and hope it goes away.
This behaves as if it is trying to hide, so I'm going to flag this as a security vulnerability.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: gnome-system-monitor 2.28.0-1ubuntu2
ProcVersionSignature: Ubuntu 2.6.32-24.38-generic 2.6.32.15+drm33.5
Uname: Linux 2.6.32-24-generic x86_64
Architecture: amd64
CheckboxSubmission: 4f08ac62e89ad166a1e0b05f95495253
CheckboxSystem: fd6c484c0b5d20a2f1cd036ef0f63975
Date: Sat Jul 17 10:47:58 2010
ProcEnviron:
 LANG=en_US.utf8
 SHELL=/bin/bash
SourcePackage: gnome-system-monitor

[DAP (akadap)]

Rebooting eliminated the nameless process.
The only things that had been done since booting before noticing this nameless process were:
open a terminal and run "runlevel" (I have been having problems with services not running occasionally)
close terminal
Started "System Monitor" and verified that cupsd and mythbackend processes were running, then switched to resources view
start Update Manager, do "check for updates" then "install updates"
The following updates were installed:

Commit Log for Sat Jul 17 10:19:05 2010

Upgraded the following packages:
icedtea-6-jre-cacao (6b18-1.8-4ubuntu1) to 6b18-1.8-4ubuntu2
icedtea6-plugin (6b18-1.8-4ubuntu1) to 6b18-1.8-4ubuntu2
openjdk-6-jre (6b18-1.8-4ubuntu1) to 6b18-1.8-4ubuntu2
openjdk-6-jre-headless (6b18-1.8-4ubuntu1) to 6b18-1.8-4ubuntu2
openjdk-6-jre-lib (6b18-1.8-4ubuntu1) to 6b18-1.8-4ubuntu2

I opened Thunderbird and read my mail
While reading my mail I noticed that more CPU that usual was being used. I checked Processes and sorted by CPU and noticed the nameless process.

[DAP (akadap)]

I just noticed another oddity: My window theme had been changed. After rebooting it is back to normal, but while the nameless process was running, my theme had three circles replacing the "close", "minimize" and "maximize" icons I usually have.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[feci (feci1024)]

According to gnome-system-monitor (by checking the dependencies option) this "nameless" process has no parent, just like "init".
I'm not even sure whether this is possible, but something must be wrong if system-monitor can't figure out it's parent. I would look in proc for details, but the process dies too quickly.

I've noticed this problem after making some configuration changes in syslog-ng (to execute sshguard when a break-in attempt is logged).

[Fabio Marconi (fabiomarconi)]

Hello
Have you reproduced it again ?
Fabio

[DAP (akadap)]

I have not seen this one in a while, but I have tracked down one that is vaguely similar:
bug #689836 which I suspect is related to Bug #67662

[atx (atx)]

I'm experiencing the same issue... Name- and parentless root processes which are dying fast. Did you found something? Really no security issue? I've some PPAs...

[atx (atx)]

Okay I figured it out! At least on my system.
Using: "ps -eopid,cmd,user,ppid | sed /\\[/d"
I've managed to get some usefull output. The gnome system monitor didn't managed to gather the process information. These disapearing "root" process were not root processes at all. It was "sleep 0.1" called by "bash /usr/share/playonlinux", so i guess it related to playonlinux and not to Ubuntu. Maybe its a bug.
Also its, quiet anyoing that the gnome system monitor produced this faulty output...

cheers!

[atx (atx)]

This could be more usefull to find such fast disapearing process, maybe it's something else on your system:

ps -eopid,cmd,user,ppid> t1.txt; ps -eopid,cmd,user,ppid > t2.txt; diff t1.txt t2.txt

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brian Murray (brian-murray)]

Reassigning to playonlinux since it is likely the root cause of this issue.

[Quentin PÂRIS (qparis)]

What is your version of PlayOnLinux

[Aymeric (mulx)]

Hum, strange.
What version of PlayOnLinux are you using?

[Aymeric (mulx)]

Please provide information asked in comment #14 or #13 (What is your version of PlayOnLinux?).

BTW, Could you produce this bug with the latest version of PlayOnlinux (you could download it on our website).

[Launchpad Janitor (janitor)]

[Expired for playonlinux (Ubuntu) because there has been no activity for 60 days.]

[kermidge (kermidge)]

This happens to me as well; just noticed about 15 minutes ago - no idea how long it has been there or whether
it's an 'always on' or sometime thing.

process [no name] user root ID anywhere from 3??? to 3???? memory N/A priority normal

when highlighted, highlight drops down to next process after a few seconds. I do not have Play-on-Linux installed, never have. Two runs of command atx at #10 gave show only 233c233 and 242c242 for diff, with user 'jonesy' and ppid '8475'. The "phantom's" ID increments by ~30 to 40 every few seconds. Shows up when view is both 'My Processes' and 'All Processes', not in 'Active'. No dependencies shown. When phantom ID reaches high 30K, drops back down to low 3000's and starts over.

Don't know about youse, but I'm gonna call this 'weird'.

[Majal (majalmirasol)]

1) Yes, this still happens.
2) I don't have PlayOnLinux installed

I posted a question here for this:
https://superuser.com/questions/741564/process-with-no-name-a-possible-linux-rootkit

Can you please help to confirm if this is a bug, or a rootkit?

[Erik Wognsen (r4mses)]

I think this is clearly a gnome-system-monitor problem: gnome-system-monitor shows short sleeps wrong, no matter whether it's playonlinux or something else that calls sleep. /bin/ps doesn't have this problem.

On both gnome-system-monitor 3.4.1-0ubuntu1 (Ubuntu 12.04) and gnome-system-monitor3.8.2.1-2ubuntu1 (Ubuntu 14.04), I can reproduce the problem like this:

- Open gnome-system-monitor
- Sort by ID (helps keep the no-name processes in a stable location in the list)
- Run in a terminal: $ while true; do sleep 0.1; done
- Look at gnome-system-monitor and click Refresh repeatedly

Look for the root process with no name. Its pid should increase by 10 per second.

If I increase the delay to 0.2, and repeatedly click Refresh, it will sometimes be the root no-name process and sometimes "sleep" owned by me. With delay 1 its name is always "sleep", but the owner is sometimes root and sometimes myself. Maybe some different values will trigger the effects for you.