3 ms·
This would help against basic ps commands but if your security tool reads the task's PF_ flags (from /proc/PID/stat or kernel memory), you'd still see that your
by tanelpoder 2y ago
This would help against basic ps commands but if your security tool reads the task's PF_ flags (from /proc/PID/stat or kernel memory), you'd still see that your [task] is not an actual kernel task... (the PF_KTHREAD flag is 0x200000):
$ ln -s /bin/sleep '[kernelstuff]'
$ ./\[kernelstuff\] 999 &
[2] 29499
$ awk '{ printf("%x\n", $9) }' /proc/29499/stat
40400000
$ pgrep kthreadd
2
$ awk '{ printf("%x\n", $9) }' /proc/2/stat
208040
Edit: as you said, it's superficial disguising (that may even work in some cases)