Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I got this:

  PID TTY      STAT   TIME COMMAND
    2 ?        S      0:00 [kthreadd]
    3 ?        S      0:00  \_ [migration/0]
            :
  844 ?        S      0:00  \_ [vmmemctl]
    1 ?        Ss     0:02 /sbin/init
  306 ?        S      0:00 upstart-udev-bridge --daemon
  309 ?        S<s    0:00 udevd --daemon
  445 ?        S<     0:00  \_ udevd --daemon
  446 ?        S<     0:00  \_ udevd --daemon
  668 ?        Ss     0:00 dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0
  713 ?        Sl     0:00 rsyslogd -c4
  717 ?        Ss     0:00 dbus-daemon --system --fork
  947 ?        S      0:03 /usr/sbin/vmtoolsd
  991 tty2     Ss+    0:00 /sbin/getty -8 38400 tty2
 1000 ?        Ss     0:00 cron
 1001 ?        Ss     0:00 atd
 1137 ?        Sl     0:00 /usr/sbin/console-kit-daemon --no-daemon
 1476 tty1     Ss+    0:00 /sbin/getty -8 38400 tty1
 9939 ?        Ss     0:00 /bin/sh -e /proc/self/fd/11
 9993 ?        S      0:00  \_ sleep 1

Any idea what's with that last process 9939? I've never seen anything like it before... It just keeps spawning a new PID on its own.

share|improve this question

migrated from stackoverflow.com Oct 23 '11 at 2:15

2 Answers

up vote 0 down vote accepted

bash supports a lot of single-character command line options:

   All of the  single-character shell options documented in the
   description of the set builtin command can be used as options
   when the shell is invoked.  In addition, bash interprets the
   following options when it is invoked:

set -e is a little complicated:

          -e      Exit immediately if a pipeline (which may
                  consist of a single simple command),  a
                  subshell command enclosed in parentheses, or
                  one of the commands executed as part of a
                  command list enclosed by braces (see SHELL
                  GRAMMAR above) exits with a non-zero status.
                  ....

It looks like this bash(1) is executing the contents of /proc/self/fd/11. Whatever spawned it probably started a pipe(2) and wants to send commands to bash(1) to execute over time. The sleep(1) command was probably executed via this pipe. Chances are good the next line in the script is to re-start a new bash -e /proc/self/fd/11. (Maybe it would be bash -e /proc/self/fd/11 11</dev/fd/11, to propagate 11 from parent to child?)

To find out which process is driving your bash(1), run lsof -p 9939. Note the inode number in the NODE column that corresponds to your pipe. (It will probably be listed as FIFO or SOCKET in the TYPE column, or pipe in the NAME column.) Then run lsof | grep inode_number -- using whichever inode number is associated with that filedescriptor.

This is a strange enough occurrence that I'm inclined to think it is portion of an attacker's toolkit. While this might be legitimate, I'm very skeptical. I'd recommend a good sweep of your logs, maybe consider running http://www.chkrootkit.org/ on your system, investigate all incoming and outgoing connections at your firewall, etc. The usual paranoia.

share|improve this answer
Hey, thanks very much for this info! I was able to use your information and craft this extended line: # cat /proc/$(lsof | grep $(lsof -p $(ps axf | grep proc | grep -v grep | cut -b1-5) | grep pipe | sed -e 's/ \+/ /g' | cut -d' ' -f8 | head -1) | sed -e 's/ \+/ /g' | grep ^sh | grep -v grep | cut -d' ' -f2 | head -1)/environ PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/sbin:/sbin:/binTERM=linuxHOME=‌​/etc/mysqlIFACE=loLOGICAL=loADDRFAM=inetMETHOD=loopbackRUNLEVEL=2PREVLEVEL=NUPSTA‌​RT_EVENTS=net-device-up local-filesystems runlevelUPSTART_JOB=mysqlUPSTART_INST – Stefan Oct 22 '11 at 14:56
I saw that it was mysql something-or-other and attempted to stop it, that process spawning is now gone. – Stefan Oct 22 '11 at 14:58
Good job! That smells a lot like a mysql upstart configuration; on my Ubuntu system, there's a post-start script segment complete with a sleep 1 mechanism, and perhaps upstart does exactly that wonky /proc/self/fd/11 shenanigans while doing its business. – sarnold Oct 22 '11 at 23:58
up vote 0 down vote

You can execute pwdx 9939 to see where the process is coming from.

pwdx is part of the proc tools, a set of utilitites that "exercise features of /proc", according to the Solaris man page.

About pwdx:

 pwdx                Print the current working  directory  of
                     each process.
share|improve this answer
That's a new command for me -- thanks for the intro to it! # pwdx 5630 5630: / – Stefan Oct 22 '11 at 5:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.