Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

w shows a list of users and the last run program by each user. What are ways to hide the last run program?

share|improve this question

migrated from Dec 21 '11 at 2:26

This question came from our site for professional and enthusiast programmers.

topwill also show your current activity... Been reading Hackernews recently? :D – three Dec 20 '11 at 15:41
wait 'til he finds out about sa – BRPocock Dec 20 '11 at 16:12
up vote 3 down vote accepted

Note: w only shows the currently running command for a user, not the last run command.

One way you can hack this is by using perl:

perl -e '$0 = "fake command"; system("....");'

If you checked the output of w on another terminal, it would say that you're running "fake command". Whatever you actually wanted to run can be put inside the system() call.

This works because $0 refers to the current program name in perl, and you're able to change it to whatever you like.

Also note that this is an absolutely hacky way of doing what you're trying to do.

Another way would just to put whatever you wanted inside a shell script, and run that. But that's not as fun.

share|improve this answer
why do i just get "Modification of a read-only value attempted at -e line 1." when i run this? – John Riselvato Dec 20 '11 at 16:28
I'm afraid I don't know, sorry. – pgl Dec 20 '11 at 16:44

What are ways to hide the last run program?

You would have to make the process attributes non-readable. The program name and/or executable name - one way or another - is found in /proc/N/{cmdline,comm,environ,exe,maps,numa_maps,smaps}... and short of unmounting /proc, making all sorts of programs not function the way they are supposed to, the prerequisite to do this in some way would be a change to the linux kernel source.

Even then, things like auditd(8) or selinux have ways to record what you are executing. If you don't like being looked over the shoulder, don't use the particular system.

share|improve this answer

The bigger security problem with having the command line visible is something like:

sqlplus uername/password@oracleinstance

Where users and batch applications access databases and/or embed passwords. If you cannot change this behavior you have to chroot users who have command line access on that system. chroot allows you to selectively prohibit or allow ordinary users access to commands like top, ps and other commands that use /proc. That is a standard approach to this kind of problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.