![]() | ||||||||||
Messages in this thread |
Hi all, Please CC me in your replies. (not subscribed to the list) I am developping a firewall application[1], that filters connections (besides other informations) on the process which is sending/receiving the packets. To get the corresponding process name I use the following method: 1.) i get the ip/port from ip_queue 2.) i search for the inode in /proc/sys/tcp[udp] 3.) i search in /proc/xxx/fd/ for the inode 4.) i get the executeable name by examining /proc/xxx/fd/exe xxx being all pids in /proc I just wanted to know if it is possible for a non-root process to modify: - /proc/PID/exe - /proc/PID/fd - /proc/sys/tcp ie: Is the infomation I get this way reliable or can it be faked. greetings Martin Maurer [1] http://fireflier.sf.net [unhandled content-type:application/pgp-signature] | |||||||||
| Last update: 2005-03-22 12:36 [from the cache] ©2003-2008 | ||||||||||