title: Is there a way can view real process cmdline on linux?
body: <p>Here is a simple code to fake process name and cmdline on linux:</p>
  
  <pre><code>#include &lt;string.h&gt;
  #include &lt;sys/prctl.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;unistd.h&gt;
  #define NewName "bash"
  #define ProcNameMaxLen 16
  
  int main(int argc, char **argv){
      int oldlen = strlen(*argv);
      char procname[ProcNameMaxLen];
      memset(*argv, 0, oldlen);
      memccpy(*argv, NewName, 0, oldlen); //modify cmdline
      memccpy(procname, NewName, 0, ProcNameMaxLen);
      prctl(PR_SET_NAME, procname); //modify procname
      sleep(60);
      return 0;
  }
  </code></pre>
  
  <p>After run this code I can't view real name by ps,</p>
  
  <p>but something can find in /proc/xxx/exe and /proc/xxx/environ, but so cumbersome.</p>
  
  <p>is there a good way can view real information with all process?</p>
  
  <p>I think this is a big security problem because i usually check process by ps on my server.</p>
  
  <hr>
  
  <p>way 1: lsof -d txt</p>
  
  <p>Wait more answer...</p>