i'm using an ubuntu 10.04 server...
when i run ps aux as root i see all processes when i run ps aux as nonroot i see JUST the processes of the current user
after a bit of research i found the following solution:
root@m85:~# ls -al /proc/
total 4
dr-xr-xr-x 122 root root 0 2010-12-23 14:08 .
drwxr-xr-x 22 root root 4096 2010-12-23 13:30 ..
dr-x------ 6 root root 0 2010-12-23 14:08 1
dr-x------ 6 root root 0 2010-12-23 14:08 10
dr-x------ 6 root root 0 2010-12-23 14:08 1212
dr-x------ 6 root root 0 2010-12-23 14:08 1227
dr-x------ 6 root root 0 2010-12-23 14:08 1242
dr-x------ 6 zabbix zabbix 0 2010-12-24 23:52 12747
[...]
my first idea was, that it got mounted in a weird way: /etc/fstab is ok and it doesn't seem to be mounted in an weird way...
my second idea was, that there might be a rootkit: but it's not a rootkit... rkhunter tells me, that there is no rootkit installed...
i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...
What could have caused such strange permissions (500) and how can i set it back to an normal level (555) ?
Crazy, i've never seen something like that...
thanks in advance for any help and merry christmas :)
I have already checked sysctl, with no result.
sysctl -a | grep ps
sysctl -a | grep proc
thanks for the tip for grsecurity: i googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.
i've also stopped apparmor, but there is still the same problem.
dpkg shows, that libselinux1 is installed, but not the selinux package...
is there another way, that i can check if grsecrity, selinux are running?
