Re: [PLUG] root "pkill: killing pid * failed: Operation not permitted"

[brent saner via plug <plug@lists.phillylinux.org>]

On Sat, Jun 8, 2024, 07:53 Michael Lazin via plug <plug@lists.phillylinux.org> wrote:

I don‘t know the specifics of how Crowdstrike security on Linux works because I have only used it on Windows or Mac but on Mac it has full disk access which is greater than root, it allows execution as system. 

root is root is root on Linux. There's no user with more privileges than root.

Likewise for root on macOS, to my recollection.

It may not be killable as root because it uses a configuration like apparmor or selinux, both of these systems can exceed the power of root.

Nope. Root can bypass/change/disable these, thus they do not "exceed the power of root". They simply interpret/intercept system calls; they're an entirely different model (MAC, RBAC) from normal *NIX/POSIX permissions (DAC, which root inherently overrides).

As JP says in the OP, SELinux is disabled.

JP, I'd first try what Steve suggested- a kill -9 or pkill -9 (SIGKILL instead of SIGTERM).

If that doesn't work, ps auxf and grep for the process, and check the process state. It may be zombie'd (Z), which in some cases (notably, it spawned from PID 1) won't clear without rebooting the machine.

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug