Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!emory!gatech!usenet.ins.cwru.edu!ncoast!allbery
From: allbery@NCoast.ORG (Brandon S. Allbery KB8JRR/AA)
Newsgroups: comp.unix.wizards
Subject: Re: Is it possible to hide process args from 'ps -ef'?? (Recap)
Message-ID: <1991Apr23.002421.17206@NCoast.ORG>
Date: 23 Apr 91 00:24:21 GMT
References: <1429@compel.UUCP> <7293@auspex.auspex.com> <1991Apr21.225044.883@servalan.uucp>
Reply-To: allbery@ncoast.ORG (Brandon S. Allbery KB8JRR/AA)
Followup-To: comp.unix.wizards
Organization: North Coast Public Access Un*x (ncoast)
Lines: 19

As quoted from <1991Apr21.225044.883@servalan.uucp> by rmtodd@servalan.uucp (Richard Todd):
+---------------
| I must admit to not having great experience with "unadulterated" SysV, but 
| on two SysV-derived systems I've used (A/UX and ISC Unix), ps by default
| only looks at the program name in the U area, but with the "f" flag will
| go ahead and find the program's stack and read the arg. list.  Also, by
+---------------

A/UX is SVR2 internally; it reads argv[] out of the program's stack.  ISC ---
which version?  Try "grep u_psargs /usr/include/sys/user.h" and see if it
finds anything --- if it does, then you have a SVR3.[12] which copies the
first part of argv[] into the ublock.

++Brandon
-- 
Me: Brandon S. Allbery			  Ham: KB8JRR/AA on 10m,2m,220,440,1.2
Internet: allbery@NCoast.ORG		       (restricted HF at present)
Delphi: ALLBERY				 AMPR: kb8jrr.AmPR.ORG [44.70.4.88]
uunet!usenet.ins.cwru.edu!ncoast!allbery       KB8JRR @ WA8BXN.OH