How to trace a process to original user?

Question

Say, on a Solaris server, user1 logs in, switches to someother user, say sruser, using su - and then starts a process of id X. And then another user user2 logs in, switches to sruser the same way and starts a process of id Y. (Multiple users can log in and swithch to sruser simultaneously.)

In the above scenario, is there any way we can trace the processes of ids X and Y to the actual users user1 and user2?

How can we trace a process to the original user?

Answer 1

there are commands to generate the process tree. The 'ps' take options 'fu' , and i think sun has ptree.

Answer 2

There is no standard way, and as far as I know there is no Solaris way either. If there was a reliable way to find out the “ancestor” user, the usual unix security model where root can do everything would not hold.

You can check each process's parent recursively. (Warning, untested script.)

pid=$1 pids=$pid user=
while pid=$(ps -o ppid= $pid); do
  user=$(ps -o ruser= $pid)
  case $user in
    0|root) :;;
    *) break;;
  esac
done
echo $user

This is not guaranteed to give any result, though. Maybe the parent's parent's parent process has exited.

You can check on what terminal a process is running (ps -o tty= $pid) and check who last logged in on that terminal (who, last). This is only indicative, though: root can start processes on any terminal.

What do you expect to see if user1 runs su user2 -c 'su user1 -c …'? It's conceivable that the OS would track the successive authentication chains in the kernel data structures associated with the process, but that's very far from the usual unix security model.