I can kill a process. But how do I keep that process from being called up again without removing it from Linux? For example, if I run something like netstat to find the port associated with the process, then kill it I will see it again running with a different PID in just a few seconds.
Change its execute permission bits. As root, use the command:
chmod a-x path_to_process_binary
This basically denies execute permission to owner, group and others (as
a = all).
This simple trick will prevent the process from running, but I believe you might have something more serious going on in your system.
If you actually need to run it yourself, check this answer.
Maybe it's a bit too much, but probably the safest way would be to use AppArmor or SELINUX to block the execution of the binary. Modifying the file permissions will work until the package that provides that binary is updated (then, it will be set as executable again when updated).
In the other hand, if you're trying to protect an entire partition so that nothing can be directly executed in it (example, protect
/tmp so that nobody can unpack and execute binaries in that directories), you can mount the partitions with the "noexec" options flag:
root@server: ~ # grep noexec /etc/fstab /dev/sda6 /tmp ext4 defaults,noexec,nosuid,nodev 1 1
root@server: /tmp # cp /usr/bin/vim . root@server: /tmp # ./vim -bash: ./vim: Permission denied
Note that shell scripts can still be executed as
/bin/sh /tmp/myscript.sh, but not directly with
The "noexec" flag is useful for webservers, because you can avoid some attacks based on downloading, compiling and executing binaries from vulnerable PHP or CGI-based sites.