Hot answers tagged

20

Most such programs only output colour codes to a terminal by default; they check to see if their output is a TTY, using isatty(3). There are usually options to override this behaviour: disable colours in all cases, or enable colours in all cases. For GNU grep for example, --color=never disables colours and --color=always enables them. In a shell you can ...


11

Is there some environment variable? Yes. It is the TERM environment variable. This is because there are several things that are used as part of the decision process. It's difficult to generalize here, because not all programs agree on a single decision flowchart. In fact GNU grep, mentioned in M. Kitt's answer, is a good example of an outlier that ...


6

As @schily says, in the ping utilility (and others), the root permissions are dropped after they are no longer necessary. This is done for security reasons. From ping.c - main() - the user is dropped with the getuid and setuid call. getuid() gets the current user, and root doing a setuid() will change the uid of the process. /* * Pull this stuff up front ...


6

SIGKILL pulls the rug out from your running process, terminating it immediately. For very simple programs this is fine; in practice however there are very few "simple" programs. Under the covers even trivial-seeming programs do all sorts of transactional work that they need to clean up from before terminating (think of the finally block in Java and other ...


4

On Linux at least, kill -- -1 Will send the SIGTERM signal to every process it can except for the calling process (so the process running that kill command which could be the shell if kill is built-in there (it usually is on POSIX shells) or the process running a standalone kill command) and the process of pid 1. Note that it does it as part of the ...


4

Adding a thread to a process is something that only the process itself can do. (Or a debugger, but then it's up to you to specify what that other thread will do.) Threads are not assigned by the operating system, they're created by the program. A thread executes code. “Adding a thread” will not magically create some code for the thread to execute. just ...


3

The uid of the second process has been reset already because there is no need to be root anymore after the sockets have been opened. The passwd utility still needs root privileges when you checked. If you like to verify this, you will need to check the source-code as the reset of the uid may be done too fast to give others a chance to verify the uid before ...


3

You can use the following script (found here) #!/bin/bash pid="$1" # first arguvment is the PID cwd="$2" # second argument is the target working directory # now let's command the GNU debugger gdb -q <<EOF attach $pid call (int) chdir("$cwd") detach quit EOF Call it by passing the PID as the first parameter and the target working directory ...


3

The general sense of @rui-f-ribeiro remark is correct, but the details are not. Details matter. Ubuntu uses these packages: iputils-ping passwd The ping utility resets permissions in a function named limit_capabilities, shared by ping and ping6. The relevant chunk of code looks like this: if (prctl(PR_SET_KEEPCAPS, 1) < 0) { ...


3

A bit dirty and there is probably a cleaner solution (maybe using SELinux or grsec) but you can hide a process by mounting an empty directory inside of /proc/<pid>. For example something like this : mount -o bind /empty/dir /proc/42 will prevent regular users from seeing process 42. They will however see that something is hidden as they will be ...


3

To have your way works you have to fix the awk syntax and use the system function to execute commands in awk: pgrep firefox | awk '{system("kill "$1)}' Then you have your own-made (wheel reinvented) equivalent of: pkill firefox as pointed out in your question comments.


2

You can use screen multiplexer such tmux. It is available via apt-get on ubuntu machines


2

For applications like Firefox, I just use killall firefox. man killall


2

Tasks do represent the number of opened processes. (Note that I do not use the term "running" to avoid confusion.) You have to realize that not all opened processes consume CPU constantly. Each process can be in a number of different states: running: actively using CPU stopped: the process was stopped (paused) by the user defunc or zombie: process ...


2

pgrep "$expression" | xargs kill -9 This will use pgrep to search for PIDs that match the specified process name, and then kick those PIDs over to kill for execution. That said, kill -9 should never be something you're running as a matter of routine; processes should be designed to handle a TERM (15) signal and clean up after themselves properly. Also, ...


2

From the manual page, section 2 for fork(): fork() creates a new process by duplicating the calling process. The new process, referred to as the child, is an exact duplicate of the calling process, referred to as the parent, except for the following points: The child has its own unique process ID, and this PID does not match the ID of any ...


2

Based on the clarification, I'm quite certain you use the words user and process incorrectly. It looks to me that you believe something is either a user, or a process (exactly one of them). This is absolutely not the case. Every running instance of an executable program code (no matter if it's started "automatically" (e.g. as part of the boot process) or ...


2

ps -o user= -p PIDHERE This selects the process PIDHERE with -p, then instructs ps to format the output by printing only the column named user; the = sign means "rename the column user to (nothing)", effectively removing the header line.


2

The detail which you are extracting from /proc/self/status is found in /proc/self/comm (without scripting). For the intended question: to determine which processes are interpreted and which are native, you cannot do this without knowing which processes are intended to be interpreters. After all, any process can rename itself via an exec call, using ...


2

You can try using setsid (part of the util-linux package) in the .xinitrc to start the script in a new session: setsid statusbar but will it still receive your signals?


2

Because of the way the mount point gets hidden with umount -l, there is no way to find which processes are still using affected files. The only way to get the list is to use lsof before umount -l to grep the relevant path. Example: lsof | grep "/mountPoint/". If you want, you can take that output to extract the PIDs and continue monitoring them.


1

Here is one way to achieve it: $ cat parent.sh #!/bin/sh echo parent.sh running ./child.sh $ cat other.sh #!/bin/sh echo other.sh running ./child.sh $ cat child.sh #!/bin/sh parent="$(ps -o comm= -p $PPID)" if [ "$parent" != parent.sh ]; then echo this script should be directly executed by parent.sh, not by $parent exit 1 fi echo ...


1

Run xprop _NET_WM_PID or xdotool selectwindow getwindowpid from a terminal then click on a window to see the process ID of the process that owns that window. (This works often but not always, see What process created this X11 window? for caveats.) One you have the process ID (e.g. 1234), ps -p 1234 -o args or ls -l /proc/1234/exe tells you what command the ...


1

Your example code does not drop privileges! It can freely elevate privileges again by calling seteuid(euid). If you can ptrace it then you can make it call seteuid(euid) and thus execute privileged code. Are you asking this because you thought ptrace was read-only? No, it isn't: strace is just one thing you can do with it; ptrace allows the tracer to ...


1

Different threads can certainly be in a different scheduler state at the same time. In fact, if they're all in the same state, that's a coincidence (except for stopped (Z), because that affects the whole process). The subdirectory /proc/PID/task contains a subdirectory per thread of the process. The files in this directory are mostly the same as in the ...


1

You can use ps command to find out about the status of all the threads of a process: ps H -p 27901 This will show all the threads related to process 27901 and their status.


1

I don't see a way to proactively tell ps to select based on pgrp, so you have to request that column then filter on it; something like: ps axo pgrp,stat,euid,ruid,tty,tpgid,sess,ppid,pid,pcpu,comm | awk -v pgrp=3668 '$1 == pgrp' ps -eo pgrp,pid,comm | sed -n -e 1p -e ' /3668/ p' PGRP=3668; ps -eo pgrp,pid,comm | sed -n -e 1p -e " / $PGRP / p"


1

When a process terminates, the PPID of its children is set to 1 (adoption by init), but the PGID (process group identifier) and the SID (session identifier) don't change. The process's children probably don't change their process group, unless they're intended to be daemons. Assuming they don't, start the process to be tested in its own process group. Call ...


1

One way to find these would be to use ps -ef, looking for rows where the parent-id is "1", e.g., #!/bin/sh orphans="$(ps -ef | awk '$3 == 1{ print $2; }')" echo "Processes which might be orphans: $orphans" However, many processes have "1" as their parent. Determining which are interesting to you can best be done by remembering which child processes your ...


1

Processes are running instances of executable binaries. Each process, similarly to each file etc., belongs to a certain user. (It's a bit more complicated because there are various user IDs for a process, but most of the time they are the same.) A terminal line (tty) can be opened by any process at any time, just as a process can open/create a file, a TCP ...



Only top voted, non community-wiki answers of a minimum length are eligible