Red Hat Bugzilla – Bug 91214
creates /proc entries not available to ' ps -aux '
Last modified: 2007-04-18 12:53:51 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR
1.0.3705; .NET CLR 1.1.4322)
Description of problem:
Booting in run level 3 with 'named' on, adds 3 entries to the /proc directory.
These processes are not visible when using the 'ps -aux' commands.
Using chkrootkit it verifies the existence of the unlisted processes.
Trying to cd into these directories, they change location making it impossible
for further investigation.
This happens on a machine NEVER loaded onto any network.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.Rebuilt new machines x5, fully patch and 'chkrootkit'
2.Complete new setup - and machine never added to a network, fully patched,
manual check and 'chkrootkit'
3.Change hardware (within i686) and replicated with all the same tests
Actual Results: Always the same result...3 hidden processes that the process
manger will not see.
'chkrootkit' views it as a possible lkm
Expected Results: All process should be registered with the process manager
Each and every time the machine is fully patched.
RH9 - 2.4.20-13.9
fixed in recent kernel patch.