lkml.org 
[lkml]   [2003]   [Jun]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subjectcan a process modify these proc filesystem informations?
From
Date
Hi all,

Please CC me in your replies. (not subscribed to the list)

I am developping a firewall application[1], that filters connections
(besides other informations) on the process which is sending/receiving
the packets. To get the corresponding process name I use the following
method:
1.) i get the ip/port from ip_queue
2.) i search for the inode in /proc/sys/tcp[udp]
3.) i search in /proc/xxx/fd/ for the inode
4.) i get the executeable name by examining /proc/xxx/fd/exe
xxx being all pids in /proc


I just wanted to know if it is possible for a non-root process to
modify:
- /proc/PID/exe
- /proc/PID/fd
- /proc/sys/tcp

ie: Is the infomation I get this way reliable or can it be faked.

greetings
Martin Maurer

[1] http://fireflier.sf.net
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:36    [W:0.078 / U:0.468 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site