Newbie question on "ps"

[John Dominic T. Binuya]

I would just like to know what the meaning of [priv] in the last column of a "ps" output means:

# ps -ef | grep priv
root 17583 1 0 Feb 13 ? 0:00 sshd: sysops [priv]
sometimes I get [net]

sshd 19746 19745 0 16:07:03 ? 0:00 sshd: jay_q [net].

thanks for the help.

[Olivier Masse · Accepted solution]

Usually this indicates privilege separation, which is a feature of modern security-related software. However, using [priv] is not a defined "standard", just good practice, and the ps command has nothing to do with this naming; the process simply asks the OS to be named that way.

My explanation might not be 100% accurate but from what I know, the "[priv]" process is a separate process that handles privileged instructions, in this case on behalf of user "sysops". This reduces the chances of having security-related bugs in the software as the codebase of the privileged process will be smaller. For example, with OpenSSH the privileged process handles all login activity while work that doesn't require any privilege is executed in a process belonging to the login user.

Olivier.

[Dennis Handly]

>Olivier: the process simply asks the OS to be named that way.

Right, nothing to do with ps(1). ps(1) just prints out argv, so it is sshd that is setting that string. Similarly with oracle. It is trying to give a distinct name for the many processes.

[John Dominic T. Binuya]

Thank you very much for clearing this up for me.