i'm using an ubuntu 10.04 server...

when i run ps aux as root i see all processes when i run ps aux as nonroot i see JUST the processes of the current user

after a bit of research i found the following solution:

root@m85:~# ls -al /proc/
total 4
dr-xr-xr-x 122 root      root         0 2010-12-23 14:08 .
drwxr-xr-x  22 root      root      4096 2010-12-23 13:30 ..
dr-x------   6 root      root         0 2010-12-23 14:08 1
dr-x------   6 root      root         0 2010-12-23 14:08 10
dr-x------   6 root      root         0 2010-12-23 14:08 1212
dr-x------   6 root      root         0 2010-12-23 14:08 1227
dr-x------   6 root      root         0 2010-12-23 14:08 1242
dr-x------   6 zabbix    zabbix       0 2010-12-24 23:52 12747

my first idea was, that it got mounted in a weird way: /etc/fstab is ok and it doesn't seem to be mounted in an weird way...

my second idea was, that there might be a rootkit: but it's not a rootkit... rkhunter tells me, that there is no rootkit installed...

i don't know if it is since the machine got installed or came with an update. i've just installed zabbix-agent on the machine and realized, that it didn't work properly...

I have already checked sysctl, with no result.

sysctl -a | grep ps
sysctl -a | grep proc

i got a tip about grsecurity and googled a bit for it. dpkg shows that i'm using the standard kernel and no grsecurity seems to be installed. also the /dev/grsec doesn't exists.

i've also stopped apparmor, but there is still the same problem.

dpkg shows, that libselinux1 is installed, but not the selinux package... /selinux is empty...

is there another way, that i can check if grsecrity, selinux are running?

What could have caused such strange permissions (500) and how can i set it back to an normal level (555) ?

Crazy, i've never seen something like that...

thanks in advance for any help and merry christmas :)

just to make it clear, what ps aux prints out (as root i see all proccesses also apache, that runs under www-data):

zabbix@m85:~$ ps aux
zabbix   12747  0.0  0.0   9760   572 ?        SN   Dec24   0:00 zabbix_agentd
zabbix   12749  0.1  0.0   9760   872 ?        SN   Dec24   2:13 zabbix_agentd
zabbix   12750  0.0  0.0   9772   784 ?        SN   Dec24   0:00 zabbix_agentd
zabbix   12751  0.0  0.0   9772   788 ?        SN   Dec24   0:00 zabbix_agentd
zabbix   12752  0.0  0.0   9772   780 ?        SN   Dec24   0:00 zabbix_agentd
zabbix   12753  0.0  0.0   9760   608 ?        SN   Dec24   0:01 zabbix_agentd
zabbix   32067  0.0  0.0  35864  1360 pts/0    S    00:54   0:00 su - zabbix
zabbix   32068 11.0  0.3  25096  6980 pts/0    S    00:54   0:00 -su
zabbix   32094  0.0  0.0  15188  1152 pts/0    R+   00:54   0:00 ps aux
jmw@m85:~$ ps aux
jmw    32361  0.0  0.0  15188  1156 pts/0    R+   00:57   0:00 ps aux

You appear to have bumped into the default Ubuntu procps version of ps which - by attempting to emulate three different argument flavors - can be downright confusing. Quoth the man page:

This version of ps accepts several kinds of options:

  1. UNIX options, which may be grouped and must be preceded by a dash.
  2. BSD options, which may be grouped and must not be used with a dash.
  3. GNU long options, which are preceded by two dashes.

Which means that ps -a yields very different results than ps a. Given my history, I'm rather fond of ps -eaH and frankly haven't needed to know the process RSS badly enough, often enough to slog through the whole manual to find which flag will give it to me.

  • This is a very good source of information. Thank you msw. Dec 26 '10 at 6:14
  • 1
    hi, thanks a lot :) but "ps -a -u -x" leads to the same result... i think ps cannot read from the /proc directory
    – JMW
    Dec 26 '10 at 10:42

This is normal behaviour since as a non root user you should only see the process from your user (only root can see all, except processes that are seen by all users eg: apache, pulseaudio stuff, alsa, etc..)

ps - Process Status


-a -> The -a option tells ps to list the processes of all users on the system rather than just those of the current user, with the exception of group leaders and processes not associated with a terminal. A group leader is the first member of a group of related processes.

-u -> The -u option tells ps to provide detailed information about each process.

-x -> The -x option adds to the list processes that have no controlling terminal, such as daemons, which are programs that are launched during booting (i.e., computer startup) and run unobtrusively in the background until they are activated by a particular event or condition.

The group leader in this case being the root.

More info here: http://www.linfo.org/ps.html

NOTE - You are asking several things in this post. The title asks one thing, you start with another and end with another. Am answering the title as it is the more relevant.

  • i ran about 60 ubuntu servers... on every other system the /proc/PID has permissions 555... ps aux always shows processes of other users, but here i just see i.e. the processes of the zabbix user, when logged in as zabbix... this is a very weid behaviour...
    – JMW
    Dec 25 '10 at 23:24
  • -1 for providing wrong information, on a regular UNIX/Linux system a regular user can list every process on the system, also there is no such thing as processes shared between users. Dec 25 '10 at 23:34
  • What i meant with PROCESS SHARED BETWEEN USERS is a process that can be seen by several users, like pulseaudio, apache service, etc.. stuff than can be seen by several users. Updated to reflect that so not to get the -1 (NOTE: Am from Venezuela so my english is not 100% perfect) Dec 25 '10 at 23:38
  • great... and the zabbix cannot see the apache process... ps aux as root shows the apache processes running under www-data but the zabbix user just sees its processes and no apache process... thats why zabbix isnt working properly
    – JMW
    Dec 25 '10 at 23:40
  • Let me understand, there is a zabbix user or are you talking about the super awesome zabbix agent hehe. If you area talking about the latter i will try to make an example in my pc to see if it has that problem. Dec 25 '10 at 23:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.