ps aux as non-root doesn't show all processes

Question

i'm using an ubuntu 10.04 server...

when i run ps aux as root i see all processes when i run ps aux as nonroot i see JUST the processes of the current user

after a bit of research i found the following solution:

root@m85:~# ls -al /proc/
total 4
dr-xr-xr-x 122 root      root         0 2010-12-23 14:08 .
drwxr-xr-x  22 root      root      4096 2010-12-23 13:30 ..
dr-x------   6 root      root         0 2010-12-23 14:08 1
dr-x------   6 root      root         0 2010-12-23 14:08 10
dr-x------   6 root      root         0 2010-12-23 14:08 1212
dr-x------   6 root      root         0 2010-12-23 14:08 1227
dr-x------   6 root      root         0 2010-12-23 14:08 1242
dr-x------   6 zabbix    zabbix       0 2010-12-24 23:52 12747
[...]

my first idea was, that it got mounted in a weird way: /etc/fstab is ok and it doesn't seem to be mounted in an weird way...

my second idea was, that there might be a rootkit: but it's not a rootkit... rkhunter tells me, that there is no rootkit installed...

i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...

What could have caused such strange permissions (500) and how can i set it back to an normal level (555) ?

Crazy, i've never seen something like that...

thanks in advance for any help and merry christmas :)

---

I have already checked sysctl, with no result.

sysctl -a | grep ps
sysctl -a | grep proc

thanks for the tip for grsecurity: i googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.

i've also stopped apparmor, but there is still the same problem.

dpkg shows, that libselinux1 is installed, but not the selinux package...

is there another way, that i can check if grsecrity, selinux are running?

Answer 1

i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...

I believe grsecurity can block the user from seeing all processes.

Answer 2

I would not be too concerned about a rootkit. That would most likely even hide some processes for root. But, I should add that running rkhunter on the box itself is not very reliable - it could have been modified by the rootkit.

I've never seen this specific issue before. Some possibilities can be:

• A sysctl setting
• SELinux
• grsecurity

Answer 3

ps only shows information about processes it can get information about. Since /proc/12747 is not readable, it will not show it if you are not root.

NOTE: This seems to be due to Ubuntu, and the (strange) way they modify their systems. It's not the first time they randomly drop permissions somewhere in the belief it would "secure" their systems, but eventually leading to programs not working "as expected" anymore — cf. https://bugs.launchpad.net/ubuntu/+source/libpam-mount/+bug/117736 . Any normal kernel has /proc/xyz directories (though not necessarily all files in it) world-readable!

Answer 4

i've already checked sysctl, with no result

sysctl -a | grep ps sysctl -a | grep proc

thanks for the tip for grsecurity: i googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.

i've also stopped apparmor, but there is still the same problem.

dpkg shows, that libselinux1 is installed, but not the selinux package...

is there another way, that i can check if grsecrity, selinux are running?