4

I am trying to implement a way to determine which user is owner of some process's session, in a way that's as cross-platform as possible.

In Linux I can trace the process's pty by following the link /proc/PID/fd/0 -> /dev/pts/31 and looking up who is the owner of this terminal in the utmp file. How do I do this in, say, AIX 6.1? /proc/PID/fd contains char files and not symlinks as Linux does... Also what is the exact structure of a single entry in utmp file on AIX 6.1? Tried to read it using 7.1 [http://www-01.ibm.com/support/knowledgecenter/ssw_aix_71/com.ibm.aix.files/utmp.h.htm] utmp structures but it does not really fit the pattern.

  • How do you define the user exactly? The owner of the terminal is one definition, the utmp record of that terminal is another. In what circumstances do you need this to be different from the process's real UID? – Gilles 'SO- stop being evil' Dec 28 '14 at 17:28
  • Okay, in other words I need to find out if user running some process has logged in to the system directly. If so - then I'll grant him access to some data stored in application. If it was root that logged in to the system and then su'ed to that user - I'll have to block him from accessing that data. – netikras Dec 28 '14 at 17:33
  • That objective is pretty different from your question. Beware of the XY problem. Note that root can easily modify the utmp file. I don't think you can do what you're describing here (“if user running some process has logged in to the system directly [as opposed to] it was root that logged in to the system and then su'ed to that user”: root doing su is a way to log in like any other). You can solve this with security frameworks such as SELinux that restrict even root, but that's very dependent on the Unix flavor. – Gilles 'SO- stop being evil' Dec 28 '14 at 17:38
  • Yes I am aware utmp can be modded easily and I am okay with that. I do not need HI-end security here, just some basic checks. Modding utmp file would require a bit more knowledge than simply su'ing to another user from root. And a different set of tools of course. It's running fine on Linux, but AIX has a bit different implementation of /proc. On Linux 'ps' command determines TTY in use in the same way as I do [found it from 'strace' output]. However I am not that familiar with 'ps' implementation on AIX and I am not sure how it determines which pts the process is assigned to. – netikras Dec 28 '14 at 18:10
1

Maybe I am over simplifying, but, can you just do this?

ps -p <pid> -F tty

Here is an example:

$ ps -p 6947010
      PID    TTY  TIME CMD
  6947010  pts/0  0:00 ksh

$ ps -p 6947010 -F tty=
 pts/0

Here is how you could determine to allow or deny access to a particular process:

You first determine who owns the process and which pts device started it by using:

$ ps -p <PID> -F tty=,user=
 pts/X  <username>

Then you check the owner of the pts/X device, like this:

$ ls -l /dev/pts/X
crw--w--w-    1 <username>  <group>     21,  0 Apr 18 13:27 /dev/pts/0

If the owner of /dev/pts/X is the same as the process owner then then the process was started by the login user and you will grant access, if the owner of the /dev/pts/X device is not the same as the owner of the process then you deny access.

  • That's quite a different thing.. I can figure out tty/pts in use with 'ps' command without a problem. But that does not tell me if the user OWNING that tty/pts is actually the same as process owner, or it's ROOT who su-ed to another user and ran that process. – netikras Apr 18 '15 at 11:01
  • 1
    On AIX 6 you can use the owner of the pts device to determine how the process was started. For example: if root logged into and then su to a different user the owner of the process will be the user, but the owner of the pts will be root, which in your case you will deny access. If the user logged in directly and started the process then the process will be again owned by the user but also the pts device will owned by the user which in that case you will grant access. When I'm talking about who owns the pts device I'm talking about the owner of the /dev/pts/X device itself. – pichogve Apr 18 '15 at 17:20
  • well that's what I needed :) Thank you. Do you have an idea how to do the same on SunOS? /devices/pseudo/pts* are all owned by root... and also CHAR devices. – netikras Apr 19 '15 at 16:35
  • Also, any ideas how 'ps' on AIX determines which pts the proces is running on? somehow truss does not tell me anything at all.... only a few lines – netikras Apr 19 '15 at 16:38
  • 1
    The AIX 'ps' command gets the process information, including pts by using the getprocs64() system function. That function returns a 'struct procsinfo' structure, and part of that structure contains the controlling tty information for a process. Look under /usr/include/procinfo.h for details on the procsinfo structure. – pichogve Apr 20 '15 at 12:13
1

If there is pts I'm assuming it's interactive, i.e pseudo terminal like pts attached. I'm using this in my bash auditor on servers, it will give you user name even if user did sudo su - to switch to root for example.

stat -c %U $(tty)
  1. Get tty name i.e /dev/pts/0
  2. Using stat, get file owner name

After shell expands $(tty) it looks like below

stat -c %U /dev/pts/0

If you were to ls -l /dev/pts you could see owners of all pseudo terminals.

  • Is stat with that syntax available on old UNIXes? Like SunOS5.8..? I honestly don't know :) I've switched my workplace so I no longer deal with unix. I kind of miss unix now :/ I wish there was a way to get a UNIX sandbox somewhere online :) And thanks for the answer. – netikras Jul 17 '17 at 6:39
0

Weird it has not been properly responded before.

#include <sys/types.h>
#include <sys/stat.h>
#include <stdio.h>

int main(int argc, char **argv)
{
   struct stat     sb;
   stat(argv[1], &sb)
   printf("%d\n", sb.st_uid);
}

It is portable between U*x and avoids utmp. Late, but can help others.

If you need the user name:

#include <pwd.h>
...
printf("%s\n", getpwuid(sb.st_uid)->pw_name);
  • And how should this program be used? What argument should be passed to it? The pty name? (1) Your program will give the same information as ls -l, which is part of the answer that was given last year. (2) This is at best only a partial answer to the question. How is the OP supposed to determine the pty name in an OS-independent way?  (3) The OS says that, on SunOS, all the pty files are owned by root, all the time. – G-Man Says 'Reinstate Monica' Oct 22 '16 at 3:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.