can't kill the process

[peterchu]

I use RH8 system now , recently the user can't kill their owner process by kill -1 pid , I hv check that the path /proc , the owner of the process change to root so the owner can't kill it ( the original owner should be ordsge ) , could suggest how can I fix it ? thx

dr-xr-xr-x 3 root ACC 0 Sep 15 17:37 10794

edp//proc> ps -ef |grep 10794
root 1037 1035 0 16:07 pts/46 00:00:00 login -- kao
ordsge 1065 1037 0 16:07 pts/46 00:00:00 /usr/local/orcale/pro /
root 13764 4977 0 17:43 pts/104 00:00:00 grep 10794

[Senthilmurugan]

Hellp peterchu,

Kill the process using the -9 option

kill -9

Eg:
#kill -9 7125

this will kill the process with the specified process ID.

Regards,
Senthil Murugan

[Muthukumar_5 · Accepted solution]

did you get any messages during kill command execution??

By the by, while check with ps command and grep try to use as,

ps -ef | grep -v grep | grep -w '10794'

where,

grep -v grep will remove grep process being create during ps check

grep -w will get exact match there..

but,
edp//proc> ps -ef |grep 10794
root 1037 1035 0 16:07 pts/46 00:00:00 login -- kao
ordsge 1065 1037 0 16:07 pts/46 00:00:00 /usr/local/orcale/pro /
root 13764 4977 0 17:43 pts/104 00:00:00 grep 10794

Seems to be strange here.

check environement variable or try to login again and check as,

ps -ef | grep 10794 again.

or as,

ps -exf | grep 10794

to get more fields

[Muthukumar_5]

And,
root 13764 4977 0 17:43 pts/104 00:00:00 grep 10794 seems wrong here.

How the normal user can kill super user there?!? it will give that error only first.

I have tested on bash shell as,

normal user> ps -ef | grep 10794
ordsge 1065 1037 0 16:07 pts/46 00:00:00 /usr/local/orcale/pro /
ordsge 13764 4977 0 17:43 pts/104 00:00:00 grep 10794


And the entries you have given is absolutly not got from execution on ps -ef |grep 10794 as,

first line root 1037 1035 0 16:07 pts/46 00:00:00 login -- kao contained no pattern as "10794"

So try as normal user and super user.. now and give results to do analysis more

[peterchu]

when kill -l the process , it pop the not the owner ,

even kill -9 still can't kill it.

[Senthilmurugan]

Hello peterchu,

Can you cut and paste the actual output from the system with "ps -aef |grep ordsge" and the output of the kill command your are trying. so that we can clearly recognize the problem

Regards,
Senthil Murugan

[Steven E. Protter]

If as root kill -9 will not kill the process or the parent process id is 1, the only way to make the process stop is by restarting the machine.

SEP

[peterchu]

thx replies,

the below is today's process with similiar problem , the process owner changed to root:ACC, so the original owner (ordsge) can't kill it even "kill -9" , root sure can kill it , but user can't do it himself , could sggest what is reason why the owner changed ? thx

#pwd
/proc

# ll 10499
dr-xr-xr-x 3 root ACC 0 Sep 16 09:24 10499


#ps -aef |grep 10499
root 10499 10498 0 09:21 pts/50 00:00:00 login -- ordsge
ordsge 10502 10499 0 09:21 pts/50 00:00:00 /usr/local/orcale/pro /
root 12348 9614 0 09:24 pts/35 00:00:00 grep 10499

[Muthukumar_5]

yep.

I have reproduced your problem as,

first terminal> Login as normal user
second terminal> root user; cd /proc/

Now on the normal user, try as,
$ su - root -c login localhost

On the super user check now,
ps -u (ps -u ordsge)

It will give some process information's related to user there,
try now as,
ps -ef | grep

As like your example,
# ll 10499
dr-xr-xr-x 3 root ACC 0 Sep 16 09:24 10499

#ps -aef |grep 10499
root 10499 10498 0 09:21 pts/50 00:00:00 login -- ordsge
ordsge 10502 10499 0 09:21 pts/50 00:00:00 /usr/local/orcale/pro /
root 12348 9614 0 09:24 pts/35 00:00:00 grep 10499

you will get it now. Where you are checking PPID 10499 for that. So at this moment we can not kill that process by the normal process. Because of step up it's owner ship turned to that owner so we can not do this.

So it is not problem there. It is trying to execute the command in super user mode so that it's permission changed to stepup user and stepup before user there.

Regards
Muthu

[peterchu]

very thx Muthukumar 's reply , even I am not totally understand it , the problem happened in my system recently but I don't know what system maint. work make this happen , could suggest the solution how can I prevent it so that the user can kill their own process ?thx

[Muthukumar_5]

Let me explain more clear.

Say user's as,

peter --> normal user
root or test --> super user or anyother user

First session:
telnet with peter

Second session:
telnet with peter

If you put ps -u peter
It will contain 3 process as,
1 for first session login process id
1 for second session login process id
1 for ps command

Now, on the second session, you are doing step up login as,

login localhost with root or anyuser
su
telnetd / ssh / rlogin (any login service)

second session > $ su - test or root

Now if you check ps as,

ps -u peter
It will contain same process there as like before.

If you try to execute as,

ps -ef | grep 'process id of first shell'
ps -ef | grep 'process id of second shell'

It will show that the process owner as root or test there by taking child process of previous shell pid there.

We can kill the process with the newly changed login user only. As usual root user can not kill any process there.

[Muthukumar_5]

By explaing better more clearly,

IF you try to step up your login from one user to another user then that login process will use the previous user's shell process id as their parent process id, so that the new process will be having the permission to kill that process. And parent process id permission will be with the previous user.

peter -----> test

pid=1089 pid=1200
ppid=1060 ppid=1089
user=peter user=test

So that 1200 process can not be kill by user peter there. The permission of process id on /proc filesystem will as,



I hope you may clear now little more.