Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Posting-Version: version B 2.10.2 9/17/84 chuqui version 1.7 9/23/84; site nsc.UUCP Path: utzoo!watmath!clyde!burl!ulysses!mhuxj!ihnp4!nsc!chuqui From: chuqui@nsc.UUCP (Zonker T. Chuqui) Newsgroups: net.unix-wizards,net.bugs.4bsd Subject: Re: automatic renice in 4.1 bsd? Message-ID: <1601@nsc.UUCP> Date: Sun, 14-Oct-84 18:19:12 EDT Article-I.D.: nsc.1601 Posted: Sun Oct 14 18:19:12 1984 Date-Received: Tue, 16-Oct-84 04:50:35 EDT References: <170@terak.UUCP> Distribution: net Organization: The Warlocks Cave, Castrovalva Lines: 34 > Look forward to any info on the subject > By reniceing the csh to 0, the terminal becomes alive > again, and renice reports the old priority as 19. > Is there some thing in 4.1 bsd that renices people when > the system load gets too high? > or do we have a malicious user who is fiddling with people's > priority. (I once looked thru lastcomm, and found that no > one had executed the renice command.) It looks like a malicious user. The renice code, unless it's been munged, only goes to 4, not 19. the only way you'll nice a process to 19 is with human intervention. They don't need to use the renice command, there is a system call they can write into their own program to do it. Note that this user (unless he is smart enough to have figured out a way around it) much as root privileges to do this on the fly. Tracking someone doing this down is difficult at best. Brute force searches through source files is a start, but if he HAS broken root he's probably smart enough to hide it (if you've given him root and he did this, cut out his tongue for me....). You could instrument the setpriority() system call (that is 4.2-- I don't know if the name changes) to log to the console things like the uid of the person calling it when it us used on a process other than itself. If /dev/kmem is writable, I'd change that immediately-- someone may have figured out a way to change the values in someone's u. in there. sigh. chuq -- From the Department of Bistromatics: Chuq Von Rospach {cbosgd,decwrl,fortune,hplabs,ihnp4,seismo}!nsc!chuqui nsc!chuqui@decwrl.ARPA How about 'reason for living?'