I'm trying to determine which group(s) a running child process has inherited. I want to find all groups the process is in given its uid. Is there a way to determine this via the /proc filesystem?
4 Answers
For the effective group id, real group id and supplementary group ids (as used for access control):
ps -o gid,rgid,supgid -p "$pid"
gid and rgid are fairly portable, supgid less so (all 3 would be available with the ps from procps as typically found on Linux-based systems).
group, rgroup and supgrp can be used to translate group ids to group names, but note that for group ids that have several corresponding group names, only one of them will be shown (same as for ls -l vs ls -n or anything that deals with user or group names based on ids).
For the process group id (as used for terminal job control):
ps -o pgid -p "$pid"
To store it into a variable:
pgid=$(($(ps -o pgid= -p "$pid")))
answered May 17, 2018 at 12:52
-
For parsing, it's helpful to omit the output of the header;
-o pgid=will do that.-pis optional and can be left out. There's still leading whitespace in the output, so do this to capture the PGID:pgid=$(ps -o pgid= "$pid" | grep -o '[0-9]\+')Commented Sep 1, 2018 at 9:16 -
@Ingo,
-pis not optional per POSIX. Neither-onor\+are standard either. Here, you could usepgid=$(($(ps -o pgid= -p "$pid")))portably if you wanted to store that pid in a variable (gives 0 if$pidis not found but preserves the exit status ofps). Commented Sep 1, 2018 at 9:24 -
Thanks for adding the parsing part into your answer, and for the notes on POSIX compatibility; that
$((...))evaluation is a really neat trick (and also slightly more efficient that usinggrep). I'm learning so much from your great answers!!! Commented Sep 1, 2018 at 9:34
The list of groups is given under Groups in /proc/<pid>/status; for example,
$ grep '^Groups' /proc/$$/status
Groups: 4 24 27 30 46 110 115 116 1000
The primary group is given under Gid:
$ grep '^Gid' /proc/$$/status
Gid: 1000 1000 1000 1000
ps is also capable of showing the groups of a process, as the other answers indicate.
-
best-practice is to use
pscommand when possible instead of opening/reading/parsing files under /proc/pid/ because the files and contents of files under /proc/pid can change whenever the kernel version changes. for example: i had a script that worked on kernel version 3.x and then the same script failed on 5.x kernel version. i changed the script to usepsand now it works in both kernel version 3.x and 5.x. Commented Jan 9 at 15:29
Using ps:
$ ps -o group,supgrp $$
GROUP SUPGRP
muru adm,cdrom,sudo,dip,www-data,plugdev,lpadmin,mlocate,sambashare,lxd,libvirtd,docker,muru
From man ps, the output columns used for -o:
egid EGID effective group ID number of the process as a
decimal integer. (alias gid).
egroup EGROUP effective group ID of the process. This will be
the textual group ID, if it can be obtained and
the field width permits, or a decimal
representation otherwise. (alias group).
gid GID see egid. (alias egid).
group GROUP see egroup. (alias egroup).
supgid SUPGID group ids of supplementary groups, if any. See
getgroups(2).
supgrp SUPGRP group names of supplementary groups, if any. See
getgroups(2).
On a UNIX system derived from SVr4, you may call:
pcred <prcess-id>
Note that the official procfs is not ASCII but binary.
-
The question is about Linux, which is not (much) derived from SVr4, so this doesn't answer the question. Also there is no such thing as “the official procfs”: each Unix variant has its own implementation of it, or doesn't have one. Commented May 17, 2018 at 16:00
-
You seem to miss that there was a paper on procfs and another one on procfs-2. Linux has not much more in common with that paper than the name procfs. Since this portal is about UNIX, it is obvious that there are people who like to know how things work on UNIX even thought the question might have been Linux specific.– schilyCommented May 17, 2018 at 20:09
sudo -g, or if the group database changed since the user logged in).