2022-12-28 03:07:13

by Tavis Ormandy

[permalink] [raw]
Subject: Re: [oss-security] [patch] proc.5: tell how to parse /proc/*/stat correctly

On 2022-12-28, Lyndon Nerenberg (VE7TFX/VE6BBM) wrote:
> Dominique Martinet writes:
>
>> But, really, I just don't see how this can practically be said to be parsable...
>
> In its current form it never will be. The solution is to place
> this variable-length field last. Then you can "cut -d ' ' -f 51-"
> to get the command+args part (assuming I counted all those fields
> correctly ...)
>
> Of course, this breaks backwards compatability.
>

I think that cut command doesn't handle newlines, you probably need cut
-z, which looks a bit hacky to me. There already is 'ps -q $$ -o comm=',
of course, and that works fine - as well as libprocps.

I don't know, I think just adding the strrchr note seems acceptable.

Tavis.


--
_o) $ lynx lock.cmpxchg8b.com
/\\ _o) _o) $ finger [email protected]
_\_V _( ) _( ) @taviso


2022-12-30 21:13:15

by Jakub Wilk

[permalink] [raw]
Subject: Re: [oss-security] [patch] proc.5: tell how to parse /proc/*/stat correctly

* Tavis Ormandy <[email protected]>, 2022-12-28 01:50:
>>>But, really, I just don't see how this can practically be said to be
>>>parsable...
>>
>>In its current form it never will be. The solution is to place this
>>variable-length field last. Then you can "cut -d ' ' -f 51-" to get
>>the command+args part (assuming I counted all those fields correctly
>>...)
>>
>>Of course, this breaks backwards compatability.
>
>I think that cut command doesn't handle newlines,

Indeed.

>There already is 'ps -q $$ -o >comm='

FWIW, "ps ... -o comm=" doesn't just print the raw comm value: it
replaces non-printable chars with punctuation characters, and it may
append " <defunct>" if the process is a zombie.

The easiest way to get unmangled comm is to read it from
/proc/$PID/comm, then strip the trailing newline.

(But I suspect most /proc/*/stat parsers don't care about the comm field
at all; they just want to skip over it to get their hands on the
following fields.)

--
Jakub Wilk