Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

If I invoke a command with arguments like so:

bob@bob-pc:~$ command -arg1 -arg2

...can other users view the arguments passed to the command?

share|improve this question
    
A simple "yes" "no" answer to this question would contradict the content and the title :P –  kizzx2 Feb 26 '11 at 4:29
    
@kizzx2: Fixed. –  bahamat Oct 17 '12 at 21:46

3 Answers 3

up vote 12 down vote accepted

In general yes, they can see it. This is from the w man page:

The following entries are displayed for each user: login name, the tty name, the remote host, login time, idle time, JCPU, PCPU, and the com‐ mand line of their current process.

The complete command line of your currently running process will be displayed. That's why you do not want to supply things like passwords through command line arguments.

share|improve this answer
    
There's no way to disable that? –  Nathan Osman Feb 25 '11 at 23:35
3  
@George There is, because rdesktop does it somehow (the password argument turns into XXXXXXXX); I'd love to know how. It might do something lame like just forking itself and passing a fake argument; I'm not sure –  Michael Mrozek Feb 25 '11 at 23:39
9  
On Linux, a process can overwrite the argument array passed to it. This is the reflected in the process tree visible by other users. However, there's still always a time when they are exposed, and may be vulnerable to race conditions and timing attacks. –  mattdm Feb 26 '11 at 0:06

In general, command line arguments are visible to all. For example, as a non-root user on OpenBSD, I can see arguments of processes running as root:

$ ps -U root -o command= |grep getty |head -n 1
/usr/libexec/getty std.9600 ttyC0

On Linux, you'll notice that all /proc/*/cmdline files are world-readable.

There may be highly specific settings in which command line arguments remain private. For example, SELinux and Solaris can altogether hide processes from other users. But unless you absolutely know you're in such a setting, assume command line arguments are public.

share|improve this answer

On standard setups the arguments are visible. As already mentioned, processes can overwrite them in memory but not before other processes have had a chance to see them.

However, the grsecurity patchset includes a patch which changes it so only the process owner (and root) can see the arguments passed to a process.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.