kenny123

Have attempted to find reasons for the output of lsof regarding unknown processes /proc/exe in particular.
Any thoughts?

RobinVossen

If not on a server, I'd terminate it and try to RCE it.
Check what it does.

__________________
My webpage: codeinject.org
New Users, please read this..
Google first, then ask..

kenny123

Hi not on a server.
I have seen outputs of lsof regularly in posts from other users and these posts also display
these outputs.
Am still yet to find an answer as to examples below which appear for multiple processes.

ksoftirqd 4 root txt unknown /proc/4/exe
kthreadd 2 root txt unknown /proc/2/exe
netns 10 root txt unknown /proc/10/exe

and so on.

I am running as root and have used lsof on a numbr of distributions.
It may be just a quirk in lsof?


Regards.

Rubberman

That simply means that proc doesn't know what the file type is. I have a lot of these on my CentOS system, so I don't think it's anything to be concerned with.

__________________
Sometimes, real fast is almost as good as real time.

kenny123

Hi this is the output of boot.log ( syslog output ) on a newly installed fedora 11system.

Has anyone a similar output? That is it is not in usual text output.

Regards






%G Welcome to Fedora

Press 'I' to enter interactive startup.

Starting udev: %G[ OK ]


Setting hostname vl: [ OK ]


mdadm: No arrays found in config file or automatically

Setting up Logical Volume Management: 2 logical volume(s) in volume group "vg_vl" now active

[ OK ]


Checking filesystems

Fedora-11-i686-L: clean, 89022/4808704 files, 986224/19229696 blocks

/dev/sda1: clean, 42/51200 files, 29177/204800 blocks

[ OK ]


Remounting root filesystem in read-write mode: [ OK ]


Mounting local filesystems: [ OK ]


Enabling local filesystem quotas: [ OK ]


Enabling /etc/fstab swaps: [ OK ]


Entering non-interactive startup

Enabling p4-clockmod driver (passive cooling only): [ OK ]


iptables: Applying firewall rules: [ OK ]


Starting auditd: [ OK ]


Starting portreserve: [ OK ]


Starting restorecond: [ OK ]


Starting system logger: [ OK ]


Starting irqbalance: [ OK ]


Starting system message bus: [ OK ]


Starting Avahi daemon... [ OK ]


Starting HAL daemon: [ OK ]


Setting network parameters... [ OK ]


Starting NetworkManager daemon: [ OK ]


Starting crond: [ OK ]
[ OK ]

Rubberman

Those are terminal escape sequences, which indicate that either you are using a serial/network console that is not an ANSI-compliant terminal, or your TERM environment is incorrect.

__________________
Sometimes, real fast is almost as good as real time.

kenny123

Hello Rubberman thanks for the reply.

By serial terminal do you mean /dev/ttyS0 or /dev/ttyS1?

As far as I am aware I am not using a terminal over a network.

How would I determine if the or a terminal is open to an external network?
And is it usual to use a serial terminal and for what purposes?

Thanks in advance.

Rubberman

Linux is a traditional multi-user system. You can have "dumb" terminals attached via RS-232 serial interfaces. There are times when you don't want a server to have a graphic console, so often you can configure the system to use a serial port as the main console port for system configuration, updates, etc. Some can also be configured for the console to be a remote system or terminal attached via ethernet. In any case, I assume that in your case, you have a standard keyboard and monitor attached to the system? If so, then possibly something is altering the default TERM environment. When your system boots into a text mode environment the default types should probably be "ansi" or something like that. Once you are in the GUI window manager and start a terminal (command line) session, the type in the terminal window will likely be "xterm", which is a superset of the "ansi" terminal type with some extra capabilities such as handling scroll-back buffers, etc.

__________________
Sometimes, real fast is almost as good as real time.

kenny123

grub2 links to sound files

Attached Images

Screenshot-1.jpg (17.5 KB, 4 views)