Messages in this thread | | | Subject | can a process modify these proc filesystem informations? | From | Martin MAURER <> | Date | 11 Jun 2003 11:06:35 +0200 |
| |
Hi all,
Please CC me in your replies. (not subscribed to the list)
I am developping a firewall application[1], that filters connections (besides other informations) on the process which is sending/receiving the packets. To get the corresponding process name I use the following method: 1.) i get the ip/port from ip_queue 2.) i search for the inode in /proc/sys/tcp[udp] 3.) i search in /proc/xxx/fd/ for the inode 4.) i get the executeable name by examining /proc/xxx/fd/exe xxx being all pids in /proc
I just wanted to know if it is possible for a non-root process to modify: - /proc/PID/exe - /proc/PID/fd - /proc/sys/tcp
ie: Is the infomation I get this way reliable or can it be faked.
greetings Martin Maurer
[1] http://fireflier.sf.net [unhandled content-type:application/pgp-signature] | |