| There's a lot of speculation about why, with the answer almost certainly security / exploitable (or backdoor), and I'll just throw an extra little tidbit in: atop seems to run persistently as root, which may be the reason for preventing it from running/uninstalling. the netatop part of atop installs a persistent kernel module, netatop.ko, as part of its installation. The module hooks netfilter to be able to monitor all traffic. If there's an exploitable flaw in the kernel module, this would be a max-severity CVE. netatop _also_ runs a persistent daemon, netatopd, which I believe from inspecting the source runs as root. The article's language about uninstalling it kinda sorta makes you think one of these three parts is in some way exploitable or backdoored -- any which way it's a privileged process, and one that's monitoring network traffic. (I'm not sure if netatop is installed by default on systems when you install atop, per czk's comment below) |
Some distributions (like Ubuntu) enable that service by default, but some others (like Fedora) don't.