Re: Weird ps behavior

From: pedwardat_private
Date: Wed Jun 16 1999 - 12:04:23 PDT

  • Next message: Ethan Benatan: "Re: IIS Remote Exploit (injection code)"

    This bug is caused by a defective 'ps'.  The /proc entries still exists for
    the process, 'ps' just fails to list it because there is no corresponding
    entry in the passwd file for that UID.
    
    Try ps -aunx, that causes 'ps' not to lookup the user in the passwd file.
    
    RedHat 6.0 ships with procps 2.0.2, this version displays '#UID' in the USER
    column, where UID is the numeric UID, when the user isn't found in the passwd
    file.
    
    In short, upgrade to 2.0.2, the Documentation/Changes file lists procps 1.2.9
    as a required package when changing to 2.2.
    
    --Perry
    
    >
    > This bug falls under the category of programs doing the "wrong thing"
    > (tm).
    >
    > Under linux 2.3.5 and procps version 1.2.2:
    >
    > When a user creates a process and it detaches from the current terminal,
    > if the
    > account is removed with the deluser,the process(es) stay active but
    > disappear from
    > the process table that ps (aux) scrolls. I would assume that it could be
    > fixed if userdel checked for active processes and terminated them before
    > removing the account. My C skills aren't
    > good enough to diagnose whether the disappearing processes are is ps or
    > a possible poor
    > decision in the control of process tables in the kernel.
    >
    > 	Feedback?
    > 						-alpen
    >
    
    
    --
    Perry Harrington          System Architecture          zelur xuniL  ()
    perryat_private          and  Administration          Think Blue.  /\
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:49:42 PDT