-3

I create a Linux Kernel Module and I try to find a way to re-parent a given process or change a given process PID. Is there any way of doing that?

I found the following link but I could not make it work.

https://www.smartspate.com/can-change-pid-process-linux-using-kernel-module/

Improve this question
2
  • What is your purpose for doing either of these things? Commented Apr 30, 2022 at 18:52
  • Kindly see the answer in the next comment. Thank you. Commented Apr 30, 2022 at 19:08

1 Answer 1

Reset to default
1

Standard unix only supports orphaning processes, not reparenting. The result of orphaning is that the process's parent becomes pid 1.

Changing the PID of a process is also not supported in standard unix and likely has severe security implications, so it is unlikely it will ever be supported.

However, you could fork a process and then have the parent fork exit. The result will be a new process with a new pid and ppid=1

Of course, it is always possible to modify the kernel source and install a new kernel, but if you aren't an expert in kernel code, expecting it to work is far fetched.

Improve this answer
4
  • I tried that solution. The process did not took as a father the PID 1 but the /usr/lib/systemd/systemd --user. Which can be killed (if you kill that father process it just lock you out of the system). My final purpose is to hide a process (by changing a PID) and his new father be unkillable (like PID 1). Do you have any idea about that? Anything that can work for my purpose. Commented Apr 30, 2022 at 19:07
  • What you are trying to do is not possible specifically to prevent things from being hidden. systemd has taken over the function of pid 1. Commented Apr 30, 2022 at 20:52
  • So it was possible in a previous kernel and now this functionality is gone? Because in the article I add it in my original question he was able to do it via kallsyms, there is no any similar way nowadays? Commented May 1, 2022 at 5:49
  • No, it has never been possible. The article you found is doing something experimental that will never be adopted and is likely to be actively blocked. Commented May 1, 2022 at 12:11

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.