ps and wall; How do they work?

[Moellers]

In <27773 at pasteur.Berkeley.EDU> achoi at cory.Berkeley.EDU (CHOI ANDREW MAN-TAT) writes:


>Hello world.  This is my first posting to this newsgroup, please
>accept my apology in advance if I have inadvertently violated any
>netiquette.

>I have the following 2 questions about command 'ps' and 'wall':

>1)  How does 'ps' work?  Where does it get the information about all
>    the processes running on the system?  I suspect it may have
>    something to do with /dev/kmem (Kernel Memory); however, since
>    I don't have read/write permission on /dev/kmem, how can
>    'ps' acquire the permission to read /dev/kmem?  Is there a
>    setuid program exec by 'ps' to get root access?

It depends very much on your system:
- the "classical" way is to give "ps" setuid root an have it access
  /dev/kmem, as You suspect.
- on more "secure" systems, or distributed systems where there are more
  than one "kernel memories", there usually is some kind of server or a
  special system call to get process information.

>2)  Even after I do 'mesg n' or 'chmod og-rx /dev/tty?', other
>    users can still send me message through command 'wall',
>    how come?  Is there anyway to prevent 'wall' from sending the
>    message?

Hmm, maybe "wall" is setuid root? After all, "wall" sould only be used
to alert users e.g. when the system goes down (if there is any time
left B-{)

>Thank you very much for your time and effort in answering these
>questions.

Much obliged, sir!

--
| Josef Moellers		|	c/o Nixdorf Computer AG	|
|  USA: mollers.pad at nixdorf.com	|	Abt. PXD-S14		|
| !USA: mollers.pad at nixdorf.de	|	Heinz-Nixdorf-Ring	|
| Phone: (+49) 5251 104662	|	D-4790 Paderborn	|