0

This question already has an answer here:

I've written a script that uses ps -G <groupid> -o uid,cmd to log the commands that a certain group of the users of a system run in time.

What I want to know is whether it's possible for the users to hide what they are doing from my script. And how can they do that if so. Please note that my users are not in sudo group. So they can't use prctl; I need another option that doesn't require administrative privileges

I thought wrapping my code in a function and setting an alias for it and calling that alias would hide my script but it doesn't seem to work. So is there anyway to hide the code from ps?

Here is an MVC of my code to show why I think the alias trick does not work:

#!/bin/bash
foo(){
    sleep 3 
    ps -G 1,2,3 -o uid,cmd -H
}
alias bar='foo'
while true
do
    sleep 1
    ${BASH_ALIASES[bar]}
    echo 1 
done

And here is a summary of the related parts of what I get as the result:

myid -bash                             (Reasonable)
myid /bin/bash ./myscript.sh           (Reasonable)
myid /bin/bash ./mysctipt.sh           (I don't care but I wonder why it's appearing twice!)
myid ps -G 1,2,3 -o uid,cmd -H         (What I don't want to be viewable)
myid sshd: myusername@pts/9            (Reasonable)

Please note that there was some indention in the output (due to -H option in ps) that I removed and the indentions of the duplicate line was different.

From this I've concluded that making alias etc does not work. By does not work I mean that my users can't make alias for their commands and run those commands and hide their commands this way. Because if they could my ps command for which I had set an alias in my script shouldn't have appeared in the result.

So here is the question in simple words:

Is there anyway for the non-sudo users of my system to run some scripts in a way that I won't be able to notice using the ps command.

p.s. Please note that I'm aware of the pam methods for logging and stuff. I just want to see if this method works.

p.s.s. I pointed out the alias method because a friend told me this will work but it didn't. So I already explained that it doesn't seem to work to prevent people from coming and giving that as an answer.

request!!!

Can someone please explain to my why my question is closed as being an exact duplicate of another question while The answers in the mentioned question does not solve my problem at all!??

marked as duplicate by Yaron, vidarlo, waltinator, Eric Carvalho, Fabby Jan 2 '18 at 12:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • @Yaron no it's not a duplicate of that. I don't want to hide the process. I want to hide the details of the executable. for example if you are running chrome people can't see the commands inside chrome. they just see the name of chrome. I don't mind if people can see that I'm running myscript.sh or something as such. I just don't want them to see the details of the commands that I'm using within my script for example the ps command. Or the awk command that I use for playing with the output(which I didn't include in the question). – yukashima huksay Jan 1 '18 at 15:50
  • @Yaron My wish is to run my command in a way that people will just see something like ls in the cmd column of ps(which is obviously not what I'm running. – yukashima huksay Jan 1 '18 at 15:50
  • did you check the answers, e.g.: using prctl(PR_SET_NAME, (unsigned long) "NewName", 0, 0, 0); ? – Yaron Jan 1 '18 at 16:06
  • 1
    The title of your question ("hide [program] executables") doesn't match the body (hide program arguments). This confusion likely contributed to the erroneous duplicate flag. I recommend that you edit your question to have matching title and body. – David Foerster Jan 2 '18 at 15:34
  • 1
    Relevant and quite possibly a duplicate if not on a different SE site: unix.stackexchange.com/q/403870/47852 – David Foerster Jan 2 '18 at 15:38
0

Why not make a shell script with the same name that calls your command but filters the output with grep? Of course add the executable's directory to the beginning of $PATH so any call to your program will be your shell script. For example:

#!/bin/bash
/bin/ps | /bin/grep -v "Process name"

That will show all processes that ps shows except "Process name". Place it in a bash shell script using the full path for your commands. Place this command in /directory/x and add the below script to /etc/profile.d/path.sh

#!/bin/bash
PATH="/directory/x:$PATH";

This will override any reference to ps to your custom script. Lmk if you have any questions and hope this helps! :)

  • I think you have misunderstood my question. My question is how can my users run their commands in a way that I won't be able to monitor them using ps. the example about my own command was because if I can't hide my own commands from ps with the alias method. Then my users won't be able to do that. so I guess making an alias doesn't work. – yukashima huksay Jan 1 '18 at 19:07
  • You could make an alias in /etc/profile.d in a script that wool apply to everyone on a system. This alias is the same type of thing as the script and path i was talking about. What do you mean you don't want to monitor users processes with ps? There is an argument for ps to limit seeing processes belonging to other users – Kyle H Jan 1 '18 at 19:19
  • I want to monitor the users with ps. I want to see if they can prevent me from monitoring them and hiding their commands from me. – yukashima huksay Jan 1 '18 at 19:23
  • Ah i see. They can't prevent your monitoring. Just obfuscating like creating a shell script that executes another program. – Kyle H Jan 1 '18 at 20:21
  • obfuscating in a way that I can't understand what command they are actually running would also be bad enough for me. How can they do that? I tried different chains of files calling each other but I couldn't obfuscate the command. only could add to the hierarchy in -H option. I even used python scripts and subprocesses. nothing worked. can you please edit your answer to include a verifiable solution for obfuscating the commands? Their goal is to run for example a grep command without any grep being visible in the output of my ps. – yukashima huksay Jan 1 '18 at 20:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.