How to Send a Signal to Process That Belongs to Different User

Is it possible to send a signal to process that belongs to different user?

Quote from kill(2):

For a process to have permission to send a signal it must either be privileged
(under Linux: have the CAP_KILL capability), or the real or effective user ID
of the sending process must equal the real or saved set-user-ID of the target
process. In the case of SIGCONT it suffices when the sending and receiving
processes belong to the same session.

You can find capabilities(7) and setcap(8) useful.

What's the best way to send a signal to all members of a process group?

You don't say if the tree you want to kill is a single process group. (This is often the case if the tree is the result of forking from a server start or a shell command line.) You can discover process groups using GNU ps as follows:

 ps x -o  "%p %r %y %x %c "

If it is a process group you want to kill, just use the kill(1) command but instead of giving it a process number, give it the negation of the group number. For example to kill every process in group 5112, use kill -TERM -- -5112.

How to monitor and kill processes started as another user?

No, in general you can't, since the kill(1) command is doing a kill(2) syscall (see also signal(7)). See also POSIX kill function, documented and saying

An implementation that provides extended security controls may impose further implementation-defined restrictions on the sending of signals, including the null signal. In particular, the system may deny the existence of some or all of the processes specified by pid.

However, Linux (but not other POSIX systems) have capabilities(7)

The Linux man page of kill(2) says:

For a process to have permission to send a signal it must either be privileged (under Linux: have the CAP_KILL capability), or the real
or effective user ID of the sending process must equal the real or
saved set-user-ID of the target process. In the case of SIGCONT it
suffices when the sending and receiving processes belong to the same
session. (Historically, the rules were different; see NOTES.)

However, you could use setuid techniques to share a real or saved set-user-ID. Be careful when using these, a mistake would open a huge security hole.

Read also about SELinux (it probably would forbid what you want to do).

Your last trick su anotherUser -c 'kill -0 $PID' would often, but not always, work. The evil is in the details (think of a script.sh running setuid programs, or using capabilities on Linux, or some SELinux or docker thing,..., etc), and the details are not standardized by POSIX.

Perhaps setting some explicit IPC communications with your particular conventions (for the purpose of querying or killing the process, with a helper "server" or "monitoring" process), e.g. using unix(7) sockets or fifo(7)-s or pipe(7)-s, could be wiser.

Maybe you want some batch processing monitor or job scheduler, e.g. GNQS. See also Docker.

Process termination by his parent or other processes

Any process that has process ID of another process with same user-id can terminate it by sending a SIGQUIT signal to that process using
kill(pid, SIGQUIT).
You need to include <sys/types.h>
and <signal.h> for using this system call.

It is stated on man page of kill:

For a process to have permission to send a signal it must either be privileged (under Linux: have the CAP_KILL capability), or the real or effective user ID of the sending process must equal the real or saved set-user-ID of the target process. In the case of SIGCONT it suffices when the sending and receiving processes belong to the same session.

What is a pythonic way of running a Python routine as another user (e.g. root)?

You cannot run a Python function as another user.

A Unix-like OS associates each process with a particular user. One cannot reassign a process to a different user unless the original owner was root to begin with. A Python function is not a process and cannot have its own user.

Can one Process signal the event created by another process under different username(both process running under different username) ?

Your event is probably local to the session where it's created, i.e. if Proc2 created an event named "ShutdownSystem", then that event is only known to other processes within that session, much like local variables in a function.

If you want your event object to exist in a global manner and be accessible from other sessions, you should prefix it with "Global\" (e.g. name it "Global\ShutdownSystem"). The system would then create it in the global namespace.

Will ctrl+c send SIGINT signals to both parent and child processes in Linux?

In both the parent and child processes I implemented a SIGINT signal
handler. So when I press "ctrl+c", will both the handlers be called at
the same time?

Yes, they both will receive SIGINT.

Or do I need to call the child process's signal handler explicitly in
the parent process's handler?

"Calling" another process' signal handler doesn't make sense. If the both the process have a handler installed then they will be called once they receive the signal SIGINT.

I just didn't quite understand what does "foreground process group"
means.

Typically, a process associated with a controlling terminal is foreground process and its process group is called foreground process group. When you start a process from the command line, it's a foreground process:

E.g.

$ ./script.sh # foreground process
$ ./script & # background process

I suggest you read about tty and The TTY demystified for a detailed explanation.



Related Topics



Leave a reply



Submit