Hi,
I have Solaris-10 server. /usr/ucb/ps auxww is showing full path if I am running it from root. But if I run it from non-root user, its output is truncated. I don't want to use any other alternate command.
Please suggest, what can be its solution.
Terminal is set to term.
Any chance running different executable?
Do you run command as /usr/ucb/ps or as ps?
What happens if you save the ps output to a file, and then look at the saved file with an editor?
I want to use only this command, as some other script is calling this, o do not want to change it.
I am running /usr/ucb/ps auxww
If I save it to file (from non root user), still output is truncated.
My only suggestion is to double-check.
$ /usr/ucb/ps auxww
.....
$ su -
Password:
# /usr/ucb/ps auxww
.....
I take it you have already done this, that the whole point you are writing is because you are sure the output is different. If that is the case, I guess I'm stumped. Anyone else?
Yes, I am giving correct and full path in root as well as non root
/usr/ucb/ps auxww
Still it is truncted.
solaris - Getting around truncated "ps" - Stack Overflow
It seems that processes you can NOT kill are truncated. It seems no way around this for this particular version of ps command.
That is the expected/designed behavior.
Outside temporarily raising your privileges (sudo/pfexec/sbit), there is no way to overcome this limitation which is a security measure.
It is working fine on few of other servers with non root user also. I was trying to compare both configurations like .profile and /etc/profile, but couldn't found much on that.
Can it be anything with colums, if I export it with .profile of non root user ?
Maybe try md5sum /usr/ucb/ps on each server and see if any differences in executable.
Maybe just accept the security behavior and figure out how to deal with it. What's the problem with the output being truncated?
Did it previously work? If so, what might have changed?
To get the extended args past the 80 characters available in /proc/[pid]/psinfo, either pargs or /usr/ucb/ps needs to be able to open and read /proc/[pid]/as - the address space of the process.
If you really need this capability for non-root users, you can set the setuid bit on the permissions for /usr/bin/pargs or /usr/ucb/ps:
chmod 4555 /usr/ucb/ps
Doing that will give all users the ability to dump the entire process argument list along with the entire process environment - for all processes. You also need to be really careful with changing permissions on Solaris base OS binaries - the standard Solaris install hard links multiple utilities to the same underlying binary, so if you change the permissions of one you change them all (there are misguided - at best - security recommendations out there that do this and wind up breaking things right and left...)
A better (worse? very hackish...) way might be something like this (off the top of my head, totally untested):
cp -p /usr/ucb/ps /usr/ucb/ps_priv
chgrp sysadmin /usr/ucb/ps_priv
chmod 4550 /usr/ucb/ps_priv
That would only allow users who are members of the sysadmin group to run the command.
They might be running an older release of Solaris with which there wasn't yet this enforcement.
Have a look to /etc/release
As I wrote, it is the expected behavior. Nothing you can change without raising your privileges as I already suggested.
Permissions and ownership is exactly same in a working and non working server for /usr/ucb/ps.
Working server is update-5 and non-working is update-8
Solaris 10 ps(1b) manual page states:
Note: The wide output option can be viewed only by a superuser or the user who owns the process.
So if it works with update 5 and its manual page has the same statement, that is a bug here, not the other way around.
I read it, but still trying to understand what setting is there in other similar servers, where this is working (without sudo)
Please don't advise that ...
Precisely. I just checked on a Solaris 10 update 2 and /usr/ucb/ps code is shared by 62 binaries, including mdb and dtrace ( man isaexec to understand why). That means you basically grant root access to anyone with adding the setuid bit to ps.
---------- Post updated at 00:12 ---------- Previous update was at 00:07 ----------
I guess pkgchk SUNWscpu will tell you. Can you post this command output ?
root@zrddoa_zone03:/# pkgchk SUNWscpu
root@zrddoa_zone03:/# pkgchk -l -p /usr/ucb/ps
Pathname: /usr/ucb/ps
Type: linked file
Source of link: ../../usr/lib/isaexec
Referenced by the following packages:
SUNWscpu
Current status: installed
Okay, wrong guess then.
I was expecting /usr/ucb/sparc/ps (or /usr/ucb/x86/ps , /usr/ucb/amd64/ps) to be modified, which would have been less unsecured than altering /usr/ucb/ps.
The non root user with which you see the whole argument list might have been granted extra privileges.
Is there a difference between auths and ppriv $$ output on the different servers ?
No difference. Output is same for both servers.
I wouldn't fight it. It wants truncated output for security. That's the reality.
If you need the ww-wide information, run the process as root.
Does non-root ps really need ww-wide information on all processes?
Yes, application team requires it. One of their script calls this command and use that info for some other script.
Also, this is already working in other servers, so they relunctant to use anything else. Let me check with Oracle also.