From owner-freebsd-questions Wed Aug 7 15:44:01 1996 Return-Path: owner-questions Received: (from root@localhost) by freefall.freebsd.org (8.7.5/8.7.3) id PAA15189 for questions-outgoing; Wed, 7 Aug 1996 15:44:01 -0700 (PDT) Received: from relay-2.mail.demon.net (disperse.demon.co.uk [158.152.1.77]) by freefall.freebsd.org (8.7.5/8.7.3) with SMTP id PAA15167 for ; Wed, 7 Aug 1996 15:43:57 -0700 (PDT) Received: from post.demon.co.uk ([158.152.1.72]) by relay-2.mail.demon.net id ak00870; 7 Aug 96 23:42 +0100 Received: from jraynard.demon.co.uk ([158.152.42.77]) by relay-3.mail.demon.net id aa19472; 7 Aug 96 23:37 +0100 Received: (from fqueries@localhost) by jraynard.demon.co.uk (8.7.5/8.6.12) id RAA02317; Wed, 7 Aug 1996 17:18:49 GMT From: James Raynard Message-Id: <199608071718.RAA02317@jraynard.demon.co.uk> Subject: Re: blocking 'WHAT' in 'w' listing To: Justin Ashworth Date: Wed, 7 Aug 1996 17:18:49 +0000 () Cc: questions@freebsd.org In-Reply-To: from "Justin Ashworth" at Aug 6, 96 02:55:39 pm X-Mailer: ELM [version 2.4 PL24 ME8a] Content-Type: text Sender: owner-questions@freebsd.org X-Loop: FreeBSD.org Precedence: bulk [re other users being able to see what you're doing using ps and w] It's certainly not impossible to prevent this - I believe that US Department of Defense guidelines require that you can only see your own processes when you use 'ps'. All we need to do now is re-write FreeBSD to conform to the DoD spec :-) > > Same code in both ps & w, right? They both use the kvm_* interface to the kernel, as could any program written by someone who really wanted to know (although they'd have to have kmem group privileges to use it)... > I don't know for sure, but that's a good point. If I were real > concerned about it, I'd write a small program that filters it out of both > of those commands. Hardcode the executable to execute ps and w, which may > be hidden as .ps and .w in some obscure directory. It's kind of an ugly > workaround, but I doubt that disabling it is built into the code. Careful here - w and uptime are hard linked to each other, and use the program name to work out which one they're running as. > Actually, now that I think about it, grab 'ps' and 'w' out of the source > tree and just compile them without those options. That would mean chopping a > simple 'cout' or 'printf' command in 'w' and a few lines that look like > they cater to the '-U' option in 'ps'. Rather than chopping them out, put a '#if 0/#endif' block around the lines in question, so it's easy to undo if you change your mind. Also, you'll need to change the header as well... > Go with my second suggestion. I got carried away with that first one > before I realized the obvious best solution. Yep, this is a much better solution. To misquote a famous chess player: if you have a good idea, stop and think about something else for a few minutes. You'll almost certainly have a better one :-)