{"action":"created","issue":{"url":"https://api.github.com/repos/neurobin/shc/issues/7","repository_url":"https://api.github.com/repos/neurobin/shc","labels_url":"https://api.github.com/repos/neurobin/shc/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/neurobin/shc/issues/7/comments","events_url":"https://api.github.com/repos/neurobin/shc/issues/7/events","html_url":"https://github.com/neurobin/shc/issues/7","id":121548973,"node_id":"MDU6SXNzdWUxMjE1NDg5NzM=","number":7,"title":"shc compiled not protected anymore with Linux kernel >= 4.2","user":{"login":"kimmot","id":8704809,"node_id":"MDQ6VXNlcjg3MDQ4MDk=","avatar_url":"https://avatars3.githubusercontent.com/u/8704809?v=4","gravatar_id":"","url":"https://api.github.com/users/kimmot","html_url":"https://github.com/kimmot","followers_url":"https://api.github.com/users/kimmot/followers","following_url":"https://api.github.com/users/kimmot/following{/other_user}","gists_url":"https://api.github.com/users/kimmot/gists{/gist_id}","starred_url":"https://api.github.com/users/kimmot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kimmot/subscriptions","organizations_url":"https://api.github.com/users/kimmot/orgs","repos_url":"https://api.github.com/users/kimmot/repos","events_url":"https://api.github.com/users/kimmot/events{/privacy}","received_events_url":"https://api.github.com/users/kimmot/received_events","type":"User","site_admin":false},"labels":[{"id":194413394,"node_id":"MDU6TGFiZWwxOTQ0MTMzOTQ=","url":"https://api.github.com/repos/neurobin/shc/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2015-12-10T18:29:51Z","updated_at":"2018-12-27T13:03:52Z","closed_at":null,"author_association":"NONE","body":"There has been radical changes in Linux kernel \"fs/proc/cmdline.c\" and now shc compiled script can be extracted completely using /proc/[pid]/cmdline!\n\nNote that this will happen with all kernel versions starting from 4.2. Example below is from Ubuntu 15.10 that is using 4.2.0-19-generic. I have also tested all available versions of shc.\n\nIt seems that copying example here is not exactly accurate (due to github web). There is lots of space betwen  \"./test.sh.x-c\" and \"#! /bin/bash\" when you watch it from /proc/22366/cmdline.\n\n$ cat test.sh\n# ! /bin/bash\n# \n\nwhile true\ndo\n    sleep 10\ndone\n\n$ shc -f test.sh\n$ ./test.sh.x &\n[1] 22366\n$ cat /proc/22366/cmdline \n./test.sh.x-c                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         #! /bin/bash\n# \n\nwhile true\ndo\n    sleep 10\ndone\n"},"comment":{"url":"https://api.github.com/repos/neurobin/shc/issues/comments/450146946","html_url":"https://github.com/neurobin/shc/issues/7#issuecomment-450146946","issue_url":"https://api.github.com/repos/neurobin/shc/issues/7","id":450146946,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MDE0Njk0Ng==","user":{"login":"TJokiel","id":29656924,"node_id":"MDQ6VXNlcjI5NjU2OTI0","avatar_url":"https://avatars1.githubusercontent.com/u/29656924?v=4","gravatar_id":"","url":"https://api.github.com/users/TJokiel","html_url":"https://github.com/TJokiel","followers_url":"https://api.github.com/users/TJokiel/followers","following_url":"https://api.github.com/users/TJokiel/following{/other_user}","gists_url":"https://api.github.com/users/TJokiel/gists{/gist_id}","starred_url":"https://api.github.com/users/TJokiel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TJokiel/subscriptions","organizations_url":"https://api.github.com/users/TJokiel/orgs","repos_url":"https://api.github.com/users/TJokiel/repos","events_url":"https://api.github.com/users/TJokiel/events{/privacy}","received_events_url":"https://api.github.com/users/TJokiel/received_events","type":"User","site_admin":false},"created_at":"2018-12-27T13:03:52Z","updated_at":"2018-12-27T13:03:52Z","author_association":"NONE","body":"'cat /proc/[pid]/cmdline' issue is covered in latest shc version but still you could reveal all script code with simple 'ps auxww' command even if you use the '-H' flag."}}
{"actor":{"display_login":"TJokiel"}}