View Single Post
  #2   (View Single Post)  
Old 8th June 2008
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,984
Default

These sorts of questions has been asked again and again over the years; searching the misc@ archives will give you an idea of just how many times.

The short answer is that you cannot "hide" files required for functionality without damaging or eliminating function. This is OpenBSD, where there is no reason to do so.

Even processes in a chrooted subsystem (where each process could have private copies of /etc, /usr, and /var) share memory. ps(1) and similar tools can be used to obtain information about running processes, regardless.

Longer answers can be found in the archives, where users have posted examples of modifications to ps(1) and other userland applications... it was pointed out to them that if a shell user can transfer data, the the shell user can transfer standard binaries and use them anyway.

Many users do not install the compiler fileset on computers they wish to keep "extra secure" -- thinking that if an attacker reached a shell, they would not be able to compile removed utilities, or perhaps even rootkits. These users do not seem to realize that, if an attacker can reach a shell, the attacker can probably bring binaries or even compilers along with them.
Reply With Quote