How can I find out which protection ring a given process is running in, and if possible can I produce a list of running processes with their respective rings? This thread gives some insight into what rings are utilised on an x86 processor: https://stackoverflow.com/questions/18717016/what-are-ring-0-and-ring-3-in-the-context-of-operating-systems

I would like to know how to find out what protection ring level processes are running in myself, not be given a description of what rings processes will be running in (although you can include it if you want).

  • 1
    if there's a creepy critter in the shadows muttering about a "precious", it's the Tolkien ring. – quixotic Dec 31 '17 at 3:15
  • @quixotic not to be confused with the token ring ;-) – Stephen Kitt Dec 31 '17 at 11:50

On x86, the current privilege level is determined by the bottom two bits of the code segment selector, i.e. the value stored in the CS register. So "all" you need to do to determine the current privilege level of a process is look at the value of its CS register.

You can do that quite easily for your own program (assuming 64-bit x86):

#include <stdint.h>
#include <stdio.h>

int main (int argc, char **argv) {
    uint64_t rcs = 0;
    asm ("mov %%cs, %0" : "=r" (rcs));
    printf("%d\n", (int) (rcs & 3));
    return 0;

For other processes, you'd have to attach to them using something like ptrace, and examine their registers. You can do this manually using gdb: identify a process, attach to it (if you're allowed to) using gdb --pid ..., then issue the gdb command info registers cs to see the current value of CS, and extract the value of the least-significant two bits.

On Linux on x86 you'll quickly see that the current privilege level is always 3: user processes always run in ring 3, except when they’re in system calls (which run in ring 0) — but you won’t be able to see them in ring 0 externally, except by tracing kernel code using ftrace for example.

  • Every normal (non-kernel thread) process runs in both ring 3 and ring 0. When a process performs a system call, it switches from ring 3 to ring 0. You can't categorize processes based on which ring they are running in, unless you are interested in which ring they are running in at a particular moment in time. – Johan Myréen Dec 31 '17 at 8:08
  • @Johan thanks, you’re right, I meant that the OP would only ever see a ring 3 CPL using the techniques mentioned in the answer. Hopefully the updated version is more accurate. – Stephen Kitt Dec 31 '17 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.