w shows a list of users and the last run program by each user. What are ways to hide the last run program?

migrated from stackoverflow.com Dec 21 '11 at 2:26

This question came from our site for professional and enthusiast programmers.

  • 3
    topwill also show your current activity... Been reading Hackernews recently? :D – three Dec 20 '11 at 15:41
  • 2
    wait 'til he finds out about sa – BRPocock Dec 20 '11 at 16:12

Note: w only shows the currently running command for a user, not the last run command.

One way you can hack this is by using perl:

perl -e '$0 = "fake command"; system("....");'

If you checked the output of w on another terminal, it would say that you're running "fake command". Whatever you actually wanted to run can be put inside the system() call.

This works because $0 refers to the current program name in perl, and you're able to change it to whatever you like.

Also note that this is an absolutely hacky way of doing what you're trying to do.

Another way would just to put whatever you wanted inside a shell script, and run that. But that's not as fun.

  • why do i just get "Modification of a read-only value attempted at -e line 1." when i run this? – John Riselvato Dec 20 '11 at 16:28
  • I'm afraid I don't know, sorry. – pgl Dec 20 '11 at 16:44

What are ways to hide the last run program?

You would have to make the process attributes non-readable. The program name and/or executable name - one way or another - is found in /proc/N/{cmdline,comm,environ,exe,maps,numa_maps,smaps}... and short of unmounting /proc, making all sorts of programs not function the way they are supposed to, the prerequisite to do this in some way would be a change to the linux kernel source.

Even then, things like auditd(8) or selinux have ways to record what you are executing. If you don't like being looked over the shoulder, don't use the particular system.


The bigger security problem with having the command line visible is something like:

sqlplus uername/password@oracleinstance

Where users and batch applications access databases and/or embed passwords. If you cannot change this behavior you have to chroot users who have command line access on that system. chroot allows you to selectively prohibit or allow ordinary users access to commands like top, ps and other commands that use /proc. That is a standard approach to this kind of problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.