Is there a way to put a process on some sort of "black list" in Linux?

  • 3
    Why don't you want to stop the monitor? Presumably, the monitor's entire job is to check whether that process is running, log the status, and possibly restart the program. – jpmc26 Feb 25 '18 at 8:45
  • 7
    This sounds like an X-Y Problem. What are you actually trying to achieve? – David Foerster Feb 25 '18 at 9:26
  • Is it the process re-spawning itself or is the monitor process re-spawning it? Potentially of interest: stackoverflow.com/questions/30980234/… – Dan Cornilescu Feb 25 '18 at 9:56
  • What actually is the monitor process? – JdeBP Feb 25 '18 at 13:08

The normal way would be to change the configuration of the monitor program so that it doesn't keep doing that thing you don't want it to do. I'm going to assume you can't do that for some reason, but anything else is a workaround that won't work in all circumstances.

You can't blacklist a process: a process is a runtime entity. The process doesn't exist until it's started. Once it's started, it's too late to prevent it from starting. And how would you identify the process that shouldn't have started, anyway?

You can blacklist a program, or more precisely, a particular installation of a program. All programs are started from an executable file. So if you arrange for the executable file not to exist, it won't start. You could remove it, rename it, or even just make it not executable:

chmod a-x /path/to/program

If you don't want or can't modify the filesystem for some reason, but have root access, you could even use a security framework such as SELinux or AppArmor to forbid the monitor from executing this particular program. But that's more complicated.

However, if a monitor keeps trying to respawn that program, it may or may not cope sensibly if the executable disappears. It may spam you (or some log files with error messages).

Assuming that the monitor only keeps the program alive (as opposed to checking the program functionality, e.g. a monitor for a web server process might periodically try to access a web page and restart the server if it isn't responding), you could replace the program by a program that does nothing but block forever. There's no program that does this in the basic utility collection, but you can write one easily:

while sleep 999999999; do :; done

Depending on why you want to block that program, you may or may not be able to achieve a similar result by suspending the process of the original program, with pkill -STOP programname or kill -STOP 1234 where 1234 is the process ID. This keeps the process around, but doing nothing until explicitly resumed (with kill -CONT). The process won't consume any CPU time, and its memory will get swapped out when the system requires RAM for other things, but it does keep consuming resources such as open files.

  • That program will only work run for 32 years ;) – jkd Feb 25 '18 at 4:30
  • 1
    @jakekimdsΨ, that's why they put the loop around sleep. :) Sadly, that's the most nines nines that can fit in a 32-bit value... – ilkkachu Feb 25 '18 at 6:59
  • Thanks for the answer! I just changed the rights of the file and it worked just fine. But what if I want to try the first method, and reconfigure the monitor process. In my case that would be the init process. How can I set which programs get started by init? – fûX Feb 25 '18 at 16:24
  • @ilkkachu oops. Didn't see that. Thanks. – jkd Feb 25 '18 at 19:47
  • 1
    @fuggs Depends on your init system. Modern Linux server/desktop systems use systemd, so it would be something like systemctl stop nameoftheservice or systemctl --now disable nameoftheservice depending on whether you want it to restart after a reboot or not. On embedded systems, it depends. – Gilles Feb 25 '18 at 22:29

I would suggest to try freezing it instead of killing it. Depending on how its monitoring process is handling it, that might be enough.

kill -STOP <pid>

A sure way is to rename that program, and then kill it one more time. When it can run again, give it back its original name.

sudo vi /etc/passwd

Delete the user which the program respawns as. This will stop the process and its respawning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.