topic Re: Newbie question on "ps" in Operating System - HP-UX

Newbie question on "ps"

John Dominic T. Binuya — Mon, 15 Feb 2010 19:14:41 GMT

I would just like to know what the meaning of [priv] in the last column of a "ps" output means:

# ps -ef | grep priv
root 17583 1 0 Feb 13 ? 0:00 sshd: sysops [priv]
sometimes I get [net]

sshd 19746 19745 0 16:07:03 ? 0:00 sshd: jay_q [net].

thanks for the help.

Re: Newbie question on "ps"

Olivier Masse — Mon, 15 Feb 2010 20:25:37 GMT

Usually this indicates privilege separation, which is a feature of modern security-related software. However, using [priv] is not a defined "standard", just good practice, and the ps command has nothing to do with this naming; the process simply asks the OS to be named that way.

My explanation might not be 100% accurate but from what I know, the "[priv]" process is a separate process that handles privileged instructions, in this case on behalf of user "sysops". This reduces the chances of having security-related bugs in the software as the codebase of the privileged process will be smaller. For example, with OpenSSH the privileged process handles all login activity while work that doesn't require any privilege is executed in a process belonging to the login user.

Olivier.

Re: Newbie question on "ps"

Dennis Handly — Mon, 15 Feb 2010 23:51:22 GMT

>Olivier: the process simply asks the OS to be named that way.

Right, nothing to do with ps(1). ps(1) just prints out argv, so it is sshd that is setting that string. Similarly with oracle. It is trying to give a distinct name for the many processes.

Re: Newbie question on "ps"

John Dominic T. Binuya — Wed, 17 Feb 2010 03:16:37 GMT

Thank you very much for clearing this up for me.