1

I can kill a process. But how do I keep that process from being called up again without removing it from Linux? For example, if I run something like netstat to find the port associated with the process, then kill it I will see it again running with a different PID in just a few seconds.

2

Change its execute permission bits. As root, use the command:

chmod a-x path_to_process_binary

This basically denies execute permission to owner, group and others (as a = all).

This simple trick will prevent the process from running, but I believe you might have something more serious going on in your system.

If you actually need to run it yourself, check this answer.

  • Please note that if you're chmoding with -a a file that is part of an RPM/DEB package, you will probably lose your modifications when the package receives an update. – sromero Apr 20 '15 at 6:19
1

Maybe it's a bit too much, but probably the safest way would be to use AppArmor or SELINUX to block the execution of the binary. Modifying the file permissions will work until the package that provides that binary is updated (then, it will be set as executable again when updated).

In the other hand, if you're trying to protect an entire partition so that nothing can be directly executed in it (example, protect /var or /tmp so that nobody can unpack and execute binaries in that directories), you can mount the partitions with the "noexec" options flag:

root@server: ~ # grep noexec /etc/fstab
/dev/sda6    /tmp   ext4   defaults,noexec,nosuid,nodev  1 1

This way:

root@server: /tmp # cp /usr/bin/vim .
root@server: /tmp # ./vim
-bash: ./vim: Permission denied

Note that shell scripts can still be executed as /bin/sh /tmp/myscript.sh, but not directly with ./myscript.sh.

The "noexec" flag is useful for webservers, because you can avoid some attacks based on downloading, compiling and executing binaries from vulnerable PHP or CGI-based sites.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.