anti 69510fb880 fix(ssh-capture): cloak syslog relay pipe and cat process ...

Rename the rsyslog→stdout pipe from /var/run/decnet-logs (dead giveaway)
to /run/systemd/journal/syslog-relay, and launch the relay via
exec -a "systemd-journal-fwd" so ps shows a plausible systemd forwarder
instead of a bare cat. Casual ps/ls inspection now shows nothing
with "decnet" in the name.

2026-04-17 22:51:34 -04:00

1.5 KiB

Raw Blame History

View Raw