Hacker News Reader

One neat thing I learned is that `argv` and `envp` are contiguous on Linux. You can change the process name that appears in `ps` by modifying memory that `argv` elements point to. If you need more space, you can also skip NULL-terminating `argv` so that it will read on into `envp`.

Chromium, for example, does this: https://source.chromium.org/chromium/chromium/src/+/master:s...

View on HN

Modifying argv is a classic trick to implement an "error log of last resort" - How can you log an error message when the I/O itself has failed (e.g. the disk is full)? You can write you message to argv. A sysadmin running ps can quickly spot a "FATAL ERROR OCCURRED" argument appears next to the program name. Famously used by DJB in his mail server.

There are OSes where altering `argv[0]` changes the ps strings, and ones where it doesn't. Arranging to support this is tricky, as it can be a way to attack users of ps(1) and /proc!

Fun fact: iTerm recently had to redesign some of their APIs because the process name APIs would be susceptible to a malicious program overwriting its argv (the normal API for this has the kernel read out of the process's address space).

Reply on news.ycombinator.com