2

cat /proc/21637/cmdline says sendmail: MTA: accepting connections which I cannot imagine to be a correct command line. Since I don't have sendmail installed nor do I find it in PATH and not even something that seems convenient in the output of locate sendmail it makes me worried (I'll ask a separate question if you tell me that the cmdline indicates an issue).

I'm using Ubuntu 16.10 with Linux 4.8.0-32-generic.

3

Applications can (and do) rewrite their command line arguments after they have started. Sometimes this is done for security purposes, sometimes for ease of presentation. IIRC, mysql or some other DB command would remove passwords given as arguments from the argument list.

I'm not sure of the method usually used for this, but one way is to re-exec with new arguments:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>

int main(int argc, char *args[], char *env[])
{
    char *argv[] = {"bar: accepting", "blah", NULL};
    if (argc == 1)
    {
        int fd = open("/proc/self/exe", O_RDONLY);
        fexecve(fd, argv, env);
    }
    else
        sleep(100);
}

Testing:

$ make foo
cc     foo.c   -o foo
$ ./foo & pgrep -fa bar
[1] 18047
18047 bar: accepting blah

Note the PIDs.

To see the actual executable being used, check /proc/<PID>/exe:

$ ./foo & ls -l /proc/$!/exe
[1] 18025
3
lrwxrwxrwx 1 muru muru 0 Jan  7 00:59 /proc/18025/exe -> /home/muru/foo

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.