Re: [PLUG] root "pkill: killing pid * failed: Operation not permitted"

[Michael Lazin via plug <plug@lists.phillylinux.org>]

I don‘t know the specifics of how Crowdstrike security on Linux works because I have only used it on Windows or Mac but on Mac it has full disk access which is greater than root, it allows execution as system.  It may not be killable as root because it uses a configuration like apparmor or selinux, both of these systems can exceed the power of root.  I suspect that you will to remove Crowdstrike using their security token as described in their documentation if you want to kill one if it‘s processes. 

Sincerely,

Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.

On Sat, Jun 8, 2024 at 3:03 AM Steve Litt via plug <plug@lists.phillylinux.org> wrote:

JP Vossen via plug said on Fri, 7 Jun 2024 16:07:36 -0400

>What could cause "pkill: killing pid * failed: Operation not
>permitted" *when run by root*?

These are the times you use ps ax and kill -9.


SteveT

Steve Litt

Autumn 2023 featured book: Rapid Learning for the 21st Century
http://www.troubleshooters.com/rl21
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug