How to Identify the User Who Owns a Process from /Proc/Pid

Is there a way to identify the user who owns a process from /proc/PID

The owner of the process is the owner of all files in the /proc/PID directory.

$ ls -l /proc/27595
total 0
dr-xr-xr-x   2 me users 0 Jul 14 11:53 attr
-r--------   1 me users 0 Jul 14 11:53 auxv
...

Also the file /proc/PID/loginuid holds the UID of the owner of the process.

$ cat /proc/27595/loginuid
1000

android - How can I find the owner of /proc/[pid] directory

You can use ls -ld /proc/[pid] to get the owner of [pid]

Process proc = Runtime.getRuntime().exec("ls -ld /proc/[pid]");
BufferedReader reader = new BufferedReader(new InputStreamReader(proc.getInputStream()));
proc.waitFor();
while (reader.ready()) {
    String line = reader.readLine();
    String owner = line.split("\\s+")[1];
}

Also you can execute ps [pid] to get the owner of [pid]

How could I get the user name from a process id in python on Linux?

You can read the uid(s) from /proc/pid/status. They're in a line that starts with Uid:. From the uid, you can derive the username with pwd.getpwuid(pid).pw_name.

UID   = 1
EUID  = 2

def owner(pid):
    '''Return username of UID of process pid'''
    for ln in open('/proc/%d/status' % pid):
        if ln.startswith('Uid:'):
            uid = int(ln.split()[UID])
            return pwd.getpwuid(uid).pw_name

(The constants are derived from fs/proc/array.c in the Linux kernel.)

Getting pid and other process information from /proc/ pid /status

The thing is /proc/[pid]/status is a text file. So your fread is copying text into the struct status - so everything will look like gibberish.

You could read the status file line by line or you could use the /proc/[pid]/stat file which contains the same information on a single line (status is for human consumption while stat is for program consumtion). To get the process id (or any other information) you would just have to tokenize that single line.

Getting list of PIDs from /proc in Linux

There is no syscall that exposes a list of PIDs unfortunately. The way you are supposed to get this information in Linux is through the /proc virtual filesystem.

If you want a list of PIDs of currently running processes, you can use opendir() and readdir() to open /proc and iterate over the list of files/directories in there. Then you can check for directories having a filename that is a number. After checking, you can then open /proc/<PID>/stat to get the information you want (in particular, you want the 12th field majflt).

Here's a simple working example (some more error checking and adjustments might be needed):

#include <sys/types.h>
#include <dirent.h>
#include <stdio.h>
#include <ctype.h>

// Helper function to check if a struct dirent from /proc is a PID directory.
int is_pid_dir(const struct dirent *entry) {
    const char *p;

    for (p = entry->d_name; *p; p++) {
        if (!isdigit(*p))
            return 0;
    }

    return 1;
}

int main(void) {
    DIR *procdir;
    FILE *fp;
    struct dirent *entry;
    char path[256 + 5 + 5]; // d_name + /proc + /stat
    int pid;
    unsigned long maj_faults;

    // Open /proc directory.
    procdir = opendir("/proc");
    if (!procdir) {
        perror("opendir failed");
        return 1;
    }

    // Iterate through all files and directories of /proc.
    while ((entry = readdir(procdir))) {
        // Skip anything that is not a PID directory.
        if (!is_pid_dir(entry))
            continue;

        // Try to open /proc/<PID>/stat.
        snprintf(path, sizeof(path), "/proc/%s/stat", entry->d_name);
        fp = fopen(path, "r");

        if (!fp) {
            perror(path);
            continue;
        }

        // Get PID, process name and number of faults.
        fscanf(fp, "%d %s %*c %*d %*d %*d %*d %*d %*u %*lu %*lu %lu",
            &pid, &path, &maj_faults
        );

        // Pretty print.
        printf("%5d %-20s: %lu\n", pid, path, maj_faults);
        fclose(fp);
    }

    closedir(procdir);
    return 0;
}

Sample output:

    1 (systemd)           : 37
   35 (systemd-journal)   : 1
   66 (systemd-udevd)     : 2
   91 (dbus-daemon)       : 4
   95 (systemd-logind)    : 1
  113 (dhclient)          : 2
  143 (unattended-upgr)   : 10
  148 (containerd)        : 11
  151 (agetty)            : 1
  ...

How to show all users process [with date, parent id, user-name] in Linux?

I think you have to scan the /proc folder. I'm going to give you an idea about how to start. Sorry but i got no time to full code your request =(

(Look here at the /proc/[pid]/stat section to discover how the stat file is formatted)

  while((dirEntry = readdir("/proc")) != NULL) 
  {

      // is a number? (pid)
      if (scanf(dirEntry->d_name, "%d", &dummy) == 1) 
      {
          // get info about the node (file or folder)
          lstat(dirEntry->d_name, &buf);

          // it must be a folder
          if (buf.st_mode != S_IFDIR)
              continue;

          // check if it's owned by the uid you need
          if (buf.st_uid != my_userid)
              continue;

          // ok i got a pid of a process owned by my user
          printf("My user own process with pid %d\n", dirEntry->d_name);

          // build full path of stat file (full of useful infos)
          sprintf(stat_path, "/proc/%s/stat", dirEntry->d_name;

          // self explaining function (you have to write it) to extract the parent pid
          parentpid = extract_the_fourth_field(stat_path);

          // printout the parent pid
          printf("parent pid: %d\n", parentpid);

          // check for the above linked manual page about stat file to get more infos
          // about the current pid
      }
  }

How to get the pid if i only know process name in linux using proc

If you can't use a tool like pgrep you could look in all the /proc/<pid> directories and looking at the exe link in each to find the one that points to the executable you want. Or you could look at cmdline in each if that helps instead.

How to find the command line of a process only if the process is from current user

You can use the following to check both command and user for the certain PID:

ps -p <PID> -o user,cmd --columns 1000 | grep `whoami`

Adding a 'grep' according to the comment.

---

Related Topics