4 ms·
One neat thing I learned is that `argv` and `envp` are contiguous on Linux. You can change the process name that appears in `ps` by modifying memory that `argv`
by chenxiaolong 6y ago
One neat thing I learned is that `argv` and `envp` are contiguous on Linux. You can change the process name that appears in `ps` by modifying memory that `argv` elements point to. If you need more space, you can also skip NULL-terminating `argv` so that it will read on into `envp`.
Chromium, for example, does this: https://source.chromium.org/chromium/chromium/src/+/master:services/service_manager/embedder/set_process_title_linux.cc;l=130;drc=1be837b6f1420d2ae8ffb47aa46fe78f522eccba https://source.chromium.org/chromium/chromium/src/+/master:s...
- segfaultbuserr 6y agoModifying argv is a classic trick to implement an "error log of last resort" - How can you log an error message when the I/O itself has failed (e.g. the disk is full)? You can write you message to argv. A sysadmin running ps can quickly spot a "FATAL ERROR OCCURRED" argument appears next to the program name. Famously used by DJB in his mail server.
- cryptonector 6y agoThere are OSes where altering `argv[0]` changes the ps strings, and ones where it doesn't. Arranging to support this is tricky, as it can be a way to attack users of ps(1) and /proc!
- saagarjha 6y agoFun fact: iTerm recently had to redesign some of their APIs because the process name APIs would be susceptible to a malicious program overwriting its argv (the normal API for this has the kernel read out of the process's address space).