If I invoke a command with arguments like so:
bob@bob-pc:~$ command -arg1 -arg2
...can other users view the arguments passed to the command?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
In general yes, they can see it. This is from the
w man page:
The following entries are displayed for each user: login name, the tty name, the remote host, login time, idle time, JCPU, PCPU, and the com‐ mand line of their current process.
The complete command line of your currently running process will be displayed. That's why you do not want to supply things like passwords through command line arguments.
In general, command line arguments are visible to all. For example, as a non-root user on OpenBSD, I can see arguments of processes running as root:
$ ps -U root -o command= |grep getty |head -n 1 /usr/libexec/getty std.9600 ttyC0
On Linux, you'll notice that all
/proc/*/cmdline files are world-readable.
There may be highly specific settings in which command line arguments remain private. For example, SELinux and Solaris can altogether hide processes from other users. But unless you absolutely know you're in such a setting, assume command line arguments are public.
On standard setups the arguments are visible. As already mentioned, processes can overwrite them in memory but not before other processes have had a chance to see them.
However, the grsecurity patchset includes a patch which changes it so only the process owner (and root) can see the arguments passed to a process.