Is there a way by which I can hide my processes from other users if
1) I am the root
2) If i am not the root

Depends what you want to hide, and what from. Can you be specific?

Suppose I am running vi or mplayer or anything like that and I dont want that anybody who logs in should get to see my processes using ps -aux
Please help me

When I enter w none of these users appear but when I type ps -aux user1,2,3 appear.
Please explain the mystery


user1 6992 0.0 0.8 46424 8888 ? S Jan07 0:02 /usr/bin/artsd -F 10 -S 4096 -s 60 -m artsmessage -l 3 -f
user2 15099 0.0 0.6 10644 7088 ? S 14:03 0:00

/usr/libexec/gconfd-2 5
user2 15358 0.0 0.4 11176 4560 ? TN 14:29 0:00 /usr/libexec/xscreensaver/stairs -root
root 15391 0.0 0.3 11984 3472 ? S 14:32 0:00 /usr/bin/gdm-binary -nodaemon
root 15414 3.2 6.1 70560 63540 ? R 14:32 16:52 /usr/X11R6/bin/X :0 -audit 0 -auth /var/gdm/:0.Xauth vt7
user3 17244 0.0 0.8 25004 8288 ? S 17:58 0:04 /usr/bin/artsd -F 10 -S 4096 -s 60 -m artsmessage -l 3 -f

I guess it is not possible for non-root. Kernel creates entries in /proc, and ps -aux reads it. To change this, you'll need to exploit a vulnerability, I guess.

sorry for this !

'w' shows logged in users, these users have gone through some login procedure, like entering login and password. But processes can get ownership through user switch, like when you run SUID binaries. This is not a login.

Is it somehow possible using nohup

Of course, if you are the system administrator, it is trivial to stop everyone who is not you from probing for active processes: you stop their permission.
chmod o-x /bin/ps
Every time someone other than root tries to execute ps -aux, they get "permission denied".

If you want to hide your own activity from everybody on a network (which you are not the admin for) then this is tricky to do and trickier to justify.

Sorry, but system administrator who will just break ps for everybody and think he has hidden everything will make a big mistake.
find /proc -mindepth 2 -maxdepth 2 -name cmdline 2>/dev/null | while read; do cat "$REPLY"; echo; done

Doesn't block finger either.

One could take steps to disable many approaches - but the only way I can think of to completely hide would be to isolate the machine I'm working on (firewall or unplug from the network).

I suppose one may write something to run in the background, intercepting attempts to read the content of /proc (say) and return dummy strings... but my main concern is: why would you want to?

One reason may be to track down a black-hat who is actively on the network... somehow I suspect this is not the reason here. However, I am prepared to be proved wrong.

I would do it with a FUSE filesystem in /proc, while real proc is root-readable-only. May even work!

Cute... something you'd have to set up as administrator though isn't it?

It's kinda a neat question for admins, since information about what is going on on the network is going to be important for all kinds of things. I'd imagine that a user hiding processes would be a concern.

I guess one could sit down at a machine on someones network and hide what one does on that machine from the network... one could reboot the machine to a live distro (for eg.) reconfigure the machine and exit.

This would mean that the machine spends some time disconnected from the network and it's servers... creating a log entry somewhere depending how it was set up.

But here, you see, I'm talking about compromising a network yet again.

So I still think the "why" part is important.

Surely you have! If you can get information about your processes, root also can. Maybe with some kernel security tricks this situation is possible to avoid, but it will be called removing root...

If root allows users to hide processes from each other - but not from root - it can give some security through obscurity benefits (if you do have good security obscurity can improve it a bit) and, what may be more important it can give some privacy or secrecy when it is needed (and root logins are guaranteed to happen only in well-controlled circumstances and with supervision).

What? You've lost me... I need the context there dude.Sure - someone could sit on the network watching other users processes to see if there are any habits which could be exploited... if users processes are private, this cannot happen.The privacy aspect is still there - who cares that a user has vi running when you cannot tell what is being edited? The actual writing is still private (except to folk actually in the same room and looking over the user's shoulder... in the end, privacy is a gentleman's agreement. When privacy is enforced with security, it risks becoming a competition -- a challenge.rotfl