How to kill a process that keeps respawning, without killing its monitor process

killprocess

Is there a way to put a process on some sort of "black list" in Linux?

Best Answer

The normal way would be to change the configuration of the monitor program so that it doesn't keep doing that thing you don't want it to do. I'm going to assume you can't do that for some reason, but anything else is a workaround that won't work in all circumstances.

You can't blacklist a process: a process is a runtime entity. The process doesn't exist until it's started. Once it's started, it's too late to prevent it from starting. And how would you identify the process that shouldn't have started, anyway?

You can blacklist a program, or more precisely, a particular installation of a program. All programs are started from an executable file. So if you arrange for the executable file not to exist, it won't start. You could remove it, rename it, or even just make it not executable:

chmod a-x /path/to/program

If you don't want or can't modify the filesystem for some reason, but have root access, you could even use a security framework such as SELinux or AppArmor to forbid the monitor from executing this particular program. But that's more complicated.

However, if a monitor keeps trying to respawn that program, it may or may not cope sensibly if the executable disappears. It may spam you (or some log files with error messages).

Assuming that the monitor only keeps the program alive (as opposed to checking the program functionality, e.g. a monitor for a web server process might periodically try to access a web page and restart the server if it isn't responding), you could replace the program by a program that does nothing but block forever. There's no program that does this in the basic utility collection, but you can write one easily:

#!/bin/sh
while sleep 999999999; do :; done

Depending on why you want to block that program, you may or may not be able to achieve a similar result by suspending the process of the original program, with pkill -STOP programname or kill -STOP 1234 where 1234 is the process ID. This keeps the process around, but doing nothing until explicitly resumed (with kill -CONT). The process won't consume any CPU time, and its memory will get swapped out when the system requires RAM for other things, but it does keep consuming resources such as open files.