CODEWITHSUNDEEP
linuxsecuritykernelposixtrace
dspjm
dspjm

Reputation: 5850

What kind of privilege do we need to trace a process in linux

It seems that we can trace other processes with trace functions? Operating system is obliged to provide such an interface. Obviously we can obtain others data such as hidden password when they call a system call, it's a risk. Is there a mechanism to prevent the process from being traced?

Upvotes: 2

Views: 119

Answers (2)

Remi Gacogne
Remi Gacogne

Reputation: 4853

You need the CAP_SYS_PTRACE capability under Linux. If you don't have it, you can only trace processes that you can send signals to, except those running set-user-ID/set-group-ID. A process can also explicitely refuse to be ptraced, using prctl() and setting the PR_SET_DUMPABLE flag.

See man ptrace(2) for more informations.

Upvotes: 2

Mathuin
Mathuin

Reputation: 800

You can always hash the password because issuing the system call, I think. And I think you require a given amount of privilege to hook the login manager's API calls, so there shouldn't be any problems.

Upvotes: 0

Related Questions