5

I looked at a list of processes and filtered out ssh-agent which correctly shows the 3 processes I expected:

$ ps -ef | grep ssh-agent
belmin   1051     1  0 16:05 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   2569     1  0 16:09 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   2655     1  0 16:09 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   5093  2596  0 16:17 pts/1    00:00:00 grep --color ssh-agent

However, if I perform a pgrep, it doesn't list the 3 processes unless I escalate to sudo:

$ pgrep -a ssh-agent

$ sudo !!
sudo pgrep -a ssh-agent
1051 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
2569 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
2655 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple

Initially, I thought it was because PPID is 1. However, this isn't a problem with other processes that have PPID as 1 so that's not it.

What am I missing here?

Update:

So apparently applying namespace argument (--ns) works without sudo---regardless of what namespace I provide:

$ for n in 'ipc' 'mnt' 'net' 'pid' 'user' 'uts'; do echo pgrep -a --ns $n ssh-agent; pgrep -a --ns $n ssh-agent; done
    pgrep -a --ns ipc ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns mnt ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns net ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns pid ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns user ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns uts ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple

Still unclear as to why. I'll keep digging.

2

Procps 3.3.13 had pgrep filter on namespaces. Mainly so pkill doesn't kill outside it's namespace. However for some processes, especially around SSH for some reason, it gives odd results.

3.3.14 has this change reverted.

2

You may have the /proc filesystem mounted with option hidepid set. This is a security feature to protect information from other users on the system. See the man page for proc for full information. You can check whether this is the case by performing grep proc /etc/mtab and seeing whether the result includes hidepid=2. You can change the setting by modifying file /etc/fstab.

  • It works, but it also hide output from ps -ef. In the question ps -ef isn't hidden. – Yurij Goncharuk Apr 19 '18 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.