Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i'm using an ubuntu 10.04 server...

when i run ps aux as root i see all processes when i run ps aux as nonroot i see JUST the processes of the current user

after a bit of research i found the following solution:

root@m85:~# ls -al /proc/
total 4
dr-xr-xr-x 122 root      root         0 2010-12-23 14:08 .
drwxr-xr-x  22 root      root      4096 2010-12-23 13:30 ..
dr-x------   6 root      root         0 2010-12-23 14:08 1
dr-x------   6 root      root         0 2010-12-23 14:08 10
dr-x------   6 root      root         0 2010-12-23 14:08 1212
dr-x------   6 root      root         0 2010-12-23 14:08 1227
dr-x------   6 root      root         0 2010-12-23 14:08 1242
dr-x------   6 zabbix    zabbix       0 2010-12-24 23:52 12747
[...]

my first idea was, that it got mounted in a weird way: /etc/fstab is ok and it doesn't seem to be mounted in an weird way...

my second idea was, that there might be a rootkit: but it's not a rootkit... rkhunter tells me, that there is no rootkit installed...

i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...

What could have caused such strange permissions (500) and how can i set it back to an normal level (555) ?

Crazy, i've never seen something like that...

thanks in advance for any help and merry christmas :)


I have already checked sysctl, with no result.

sysctl -a | grep ps
sysctl -a | grep proc

thanks for the tip for grsecurity: i googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.

i've also stopped apparmor, but there is still the same problem.

dpkg shows, that libselinux1 is installed, but not the selinux package...

is there another way, that i can check if grsecrity, selinux are running?

share|improve this question
add comment

4 Answers 4

I would not be too concerned about a rootkit. That would most likely even hide some processes for root. But, I should add that running rkhunter on the box itself is not very reliable - it could have been modified by the rootkit.

I've never seen this specific issue before. Some possibilities can be:

share|improve this answer
    
I've seen this issue with selinux. I don't know, if ubuntu server running selinux, but if it is, it might be the cause. –  rvs Jun 9 '11 at 14:25
add comment

ps only shows information about processes it can get information about. Since /proc/12747 is not readable, it will not show it if you are not root.

NOTE: This seems to be due to Ubuntu, and the (strange) way they modify their systems. It's not the first time they randomly drop permissions somewhere in the belief it would "secure" their systems, but eventually leading to programs not working "as expected" anymore — cf. https://bugs.launchpad.net/ubuntu/+source/libpam-mount/+bug/117736 . Any normal kernel has /proc/xyz directories (though not necessarily all files in it) world-readable!

share|improve this answer
    
Ubuntu is quite used to modify the system in a strange way to "enforce security"... Nonetheless, as @Øystein previously said, this question should rather be posted on another site like askubuntu.com or superuser.com –  jHackTheRipper Dec 25 '10 at 20:21
    
I'm confused about your link, if you read the comments it's not a problem in Ubuntu but a problem in OpenSSH - bugzilla.mindrot.org/show_bug.cgi?id=926 –  ta.speot.is Dec 25 '10 at 21:19
add comment

i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...

I believe grsecurity can block the user from seeing all processes.

share|improve this answer
    
It is unlikely ub 10.04 uses grsec. –  user61188 Dec 25 '10 at 18:40
add comment

i've already checked sysctl, with no result

sysctl -a | grep ps sysctl -a | grep proc

thanks for the tip for grsecurity: i googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.

i've also stopped apparmor, but there is still the same problem.

dpkg shows, that libselinux1 is installed, but not the selinux package...

is there another way, that i can check if grsecrity, selinux are running?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.