New answers tagged

1

Because of the way the mount point gets hidden with umount -l, there is no way to find which processes are still using affected files. The only way to get the list is to use lsof before umount -l to grep the relevant path. Example: lsof | grep "/mountPoint/". If you want, you can take that output to extract the PIDs and continue monitoring them.


0

Unfortunately there is no reliable way to know exactly what process was killed by pid, process ids are assigned by the scheduler as it loads them to the task queue , so is very likely that one process can have different ids depending on how and when they are loaded. However, it is possible that some task helper process such as systemd|sysvinit|etc..., had ...


1

You can try using setsid (part of the util-linux package) in the .xinitrc to start the script in a new session: setsid statusbar but will it still receive your signals?


1

Here is one way to achieve it: $ cat parent.sh #!/bin/sh echo parent.sh running ./child.sh $ cat other.sh #!/bin/sh echo other.sh running ./child.sh $ cat child.sh #!/bin/sh parent="$(ps -o comm= -p $PPID)" if [ "$parent" != parent.sh ]; then echo this script should be directly executed by parent.sh, not by $parent exit 1 fi echo ...


0

I suggest reading Section 8.4.6 Using fork and execve to Run Programs on http://www.groupes.polymtl.ca/inf2610/documentation/ComputerSystemBook.pdf


1

Run xprop _NET_WM_PID or xdotool selectwindow getwindowpid from a terminal then click on a window to see the process ID of the process that owns that window. (This works often but not always, see What process created this X11 window? for caveats.) One you have the process ID (e.g. 1234), ps -p 1234 -o args or ls -l /proc/1234/exe tells you what command the ...


2

ps -o user= -p PIDHERE This selects the process PIDHERE with -p, then instructs ps to format the output by printing only the column named user; the = sign means "rename the column user to (nothing)", effectively removing the header line.


2

The detail which you are extracting from /proc/self/status is found in /proc/self/comm (without scripting). For the intended question: to determine which processes are interpreted and which are native, you cannot do this without knowing which processes are intended to be interpreters. After all, any process can rename itself via an exec call, using ...


0

It appears processes get Names in </proc/self/status |grep '^Name' and the name appears to be the basename of the real zeroth argument. (I'll keep the question here in case someone provides a better answer).


1

Your example code does not drop privileges! It can freely elevate privileges again by calling seteuid(euid). If you can ptrace it then you can make it call seteuid(euid) and thus execute privileged code. Are you asking this because you thought ptrace was read-only? No, it isn't: strace is just one thing you can do with it; ptrace allows the tracer to ...


0

Mutexes are part of POSIX, so you can use them in Linux too - see examples.


1

Different threads can certainly be in a different scheduler state at the same time. In fact, if they're all in the same state, that's a coincidence (except for stopped (Z), because that affects the whole process). The subdirectory /proc/PID/task contains a subdirectory per thread of the process. The files in this directory are mostly the same as in the ...


0

That seems a good guess, because of the possibility of switching back, which is a known area where a security problem would result. Further reading: 12. Local root exploits (Hacker's hut) Re: Preventing ptrace() Jan 03 2003 04:38AM


0

Interesting no one mentioned this one. pidof outputs space-separated pids of processes matching the passed process name. As such, you can directly use its output with kill without piping. On Arch Linux I use kill -9 $(pidof <proc name>) The downside to this solution being that it does not allow for use of regular expressions.


1

You can use ps command to find out about the status of all the threads of a process: ps H -p 27901 This will show all the threads related to process 27901 and their status.


1

I don't see a way to proactively tell ps to select based on pgrp, so you have to request that column then filter on it; something like: ps axo pgrp,stat,euid,ruid,tty,tpgid,sess,ppid,pid,pcpu,comm | awk -v pgrp=3668 '$1 == pgrp' ps -eo pgrp,pid,comm | sed -n -e 1p -e ' /3668/ p' PGRP=3668; ps -eo pgrp,pid,comm | sed -n -e 1p -e " / $PGRP / p"


11

Is there some environment variable? Yes. It is the TERM environment variable. This is because there are several things that are used as part of the decision process. It's difficult to generalize here, because not all programs agree on a single decision flowchart. In fact GNU grep, mentioned in M. Kitt's answer, is a good example of an outlier that ...


20

Most such programs only output colour codes to a terminal by default; they check to see if their output is a TTY, using isatty(3). There are usually options to override this behaviour: disable colours in all cases, or enable colours in all cases. For GNU grep for example, --color=never disables colours and --color=always enables them. In a shell you can ...


0

Technically, almost anything is possible with ptrace() / gdb. Search results. Using ptrace() is arch-dependent, awkward, and AFAICT no-one's implemented it for you. The popular application is to inject an fd into the process, but that's about the opposite of what you want. I thought about what would be required and it looks very painful. You could use ...


0

godlygeek's answer is good for understanding how the system works but the subsequent question that inevitably follows is: How to determine if a process has gone away? The correct way to wait on a process in another process group or session is to use kill(). Obviously, that is an unintuitive answer. You can't use the wait family of functions because the ...


4

On Linux at least, kill -- -1 Will send the SIGTERM signal to every process it can except for the calling process (so the process running that kill command which could be the shell if kill is built-in there (it usually is on POSIX shells) or the process running a standalone kill command) and the process of pid 1. Note that it does it as part of the ...


0

Can you? Yes. Should you? under nearly all circumstances, no. But: init ignores SIGTERM on Linux, explicitly. So you could simply do killall -TERM '*'.


1

When a process terminates, the PPID of its children is set to 1 (adoption by init), but the PGID (process group identifier) and the SID (session identifier) don't change. The process's children probably don't change their process group, unless they're intended to be daemons. Assuming they don't, start the process to be tested in its own process group. Call ...


1

One way to find these would be to use ps -ef, looking for rows where the parent-id is "1", e.g., #!/bin/sh orphans="$(ps -ef | awk '$3 == 1{ print $2; }')" echo "Processes which might be orphans: $orphans" However, many processes have "1" as their parent. Determining which are interesting to you can best be done by remembering which child processes your ...


2

pgrep "$expression" | xargs kill -9 This will use pgrep to search for PIDs that match the specified process name, and then kick those PIDs over to kill for execution. That said, kill -9 should never be something you're running as a matter of routine; processes should be designed to handle a TERM (15) signal and clean up after themselves properly. Also, ...


3

The general sense of @rui-f-ribeiro remark is correct, but the details are not. Details matter. Ubuntu uses these packages: iputils-ping passwd The ping utility resets permissions in a function named limit_capabilities, shared by ping and ping6. The relevant chunk of code looks like this: if (prctl(PR_SET_KEEPCAPS, 1) < 0) { ...


6

As @schily says, in the ping utilility (and others), the root permissions are dropped after they are no longer necessary. This is done for security reasons. From ping.c - main() - the user is dropped with the getuid and setuid call. getuid() gets the current user, and root doing a setuid() will change the uid of the process. /* * Pull this stuff up front ...


2

Based on the clarification, I'm quite certain you use the words user and process incorrectly. It looks to me that you believe something is either a user, or a process (exactly one of them). This is absolutely not the case. Every running instance of an executable program code (no matter if it's started "automatically" (e.g. as part of the boot process) or ...


1

Processes are running instances of executable binaries. Each process, similarly to each file etc., belongs to a certain user. (It's a bit more complicated because there are various user IDs for a process, but most of the time they are the same.) A terminal line (tty) can be opened by any process at any time, just as a process can open/create a file, a TCP ...


3

The uid of the second process has been reset already because there is no need to be root anymore after the sockets have been opened. The passwd utility still needs root privileges when you checked. If you like to verify this, you will need to check the source-code as the reset of the uid may be done too fast to give others a chance to verify the uid before ...


3

You can use the following script (found here) #!/bin/bash pid="$1" # first arguvment is the PID cwd="$2" # second argument is the target working directory # now let's command the GNU debugger gdb -q <<EOF attach $pid call (int) chdir("$cwd") detach quit EOF Call it by passing the PID as the first parameter and the target working directory ...


0

Check out this Answer Here is the link to the tool


4

Adding a thread to a process is something that only the process itself can do. (Or a debugger, but then it's up to you to specify what that other thread will do.) Threads are not assigned by the operating system, they're created by the program. A thread executes code. “Adding a thread” will not magically create some code for the thread to execute. just ...


2

From the manual page, section 2 for fork(): fork() creates a new process by duplicating the calling process. The new process, referred to as the child, is an exact duplicate of the calling process, referred to as the parent, except for the following points: The child has its own unique process ID, and this PID does not match the ID of any ...


6

SIGKILL pulls the rug out from your running process, terminating it immediately. For very simple programs this is fine; in practice however there are very few "simple" programs. Under the covers even trivial-seeming programs do all sorts of transactional work that they need to clean up from before terminating (think of the finally block in Java and other ...


0

Use screen's log command (!) Since the process is running in a screen session already it's just a matter of telling screen to log the output of that window: Switch to the script's window, C-a H to log. Now you can : $ tail -f screenlog.2 | grep whatever From screen's man page: log [on|off] Start/stop writing output of the current window to a ...


2

You can use screen multiplexer such tmux. It is available via apt-get on ubuntu machines


2

Tasks do represent the number of opened processes. (Note that I do not use the term "running" to avoid confusion.) You have to realize that not all opened processes consume CPU constantly. Each process can be in a number of different states: running: actively using CPU stopped: the process was stopped (paused) by the user defunc or zombie: process ...


0

A process is a running instance of a program. The numbers mean that 24 tasks are receiving inputs from the terminal while the rest are running in the background. There is a very good post here: http://www.makeuseof.com/answers/single-core-processor-run-multiple-tasks/ Also here to learn more about linux processes: http://www.linfo.org/process.html


1

Did you use yum to uninstall it? I would check for any startup/upstart/init.d scripts that might be lingering around. As a last resort, if there are no startup scripts, you can try moving it to the /tmp/ directory: sudo mv `which sosreport` /tmp/


3

A bit dirty and there is probably a cleaner solution (maybe using SELinux or grsec) but you can hide a process by mounting an empty directory inside of /proc/<pid>. For example something like this : mount -o bind /empty/dir /proc/42 will prevent regular users from seeing process 42. They will however see that something is hidden as they will be ...


0

Below stuff may help : var=$(pgrep process_name_here); top -b -p "$var" | awk -v var=$var '$1~var{print $10}' You might even think of writing a script and passing the process name as argument Note: This solution will not work if you change the default layout for the top command. In that case you need to replace $10 with appropriate field number


0

Very Fast Way to Kill Multiple Processes (without having to write a script) USAGE: ./autokill.kl.sh <proc-name> => This will give you 5 seconds to change your mind and control-C out of the program. USAGE: ./autokill.kl.sh <proc-name> now => This will immediately kill all processes matching the string/pattern you specified!!! MODEL: ...


1

Any program can allocate a pseudo-terminal, it doesn't have to involve a login. It's just another form of inter-process communication, which is useful if the application needs to emulate a terminal. An example is the Expect program. It allocates a pseudo-terminal when it spawns a program, so that the program will act as if it's being run interactively by a ...


0

You can use, sar -w. For instance, sar -w 1 3, reports total number of context switches per second for every 1 seconds a total of 3 times.


2

For applications like Firefox, I just use killall firefox. man killall


3

To have your way works you have to fix the awk syntax and use the system function to execute commands in awk: pgrep firefox | awk '{system("kill "$1)}' Then you have your own-made (wheel reinvented) equivalent of: pkill firefox as pointed out in your question comments.


0

By itself, lsof -i will only list Internet information. You can add file information (or show that instead) using the -d option. For example: lsof -d txt | grep -E '/httpd.pl$' because (unless a process changes the name under which it runs) the command name will match the actual filename which was loaded. That file has to be executable, of course ...


4

You could install the package nethogs if it is available for your system. This command is similar to top and will show you your running processes and how much network traffic they are generating. Use this command sequence: nethogs nethogs my_interface(s) If nethogs is not available you might try the iptraf command which will sort connections by usage. ...


2

You can use something like this while sleep 1;do ps -eo start_time,pid,euser,args:100 --sort start_time;done This will list all processes running in order of start time although it will be latest at the bottom. The loop update every second, if you need a finer time period change the sleep as needed. If you want the latest at the top you can pipe into tac ...



Top 50 recent answers are included