Determine which group(s) a running process is in?

Question

I'm trying to determine which group(s) a running child process has inherited. I want to find all groups the process is in given its uid. Is there a way to determine this via the /proc filesystem?

Solution 1

The list of groups is given under Groups in /proc/<pid>/status; for example,

$ grep '^Groups' /proc/$$/status
Groups: 4 24 27 30 46 110 115 116 1000

The primary group is given under Gid:

$ grep '^Gid' /proc/$$/status
Gid:    1000    1000    1000    1000

ps is also capable of showing the groups of a process, as the other answers indicate.

Solution 2

For the effective group id, real group id and supplementary group ids (as used for access control):

ps -o gid,rgid,supgid -p "$pid"

gid and rgid are fairly portable, supgid less so (all 3 would be available with the ps from procps as typically found on Linux-based systems).

group, rgroup and supgrp can be used to translate group ids to group names, but note that for group ids that have several corresponding group names, only one of them will be shown (same as for ls -l vs ls -n or anything that deals with user or group names based on ids).

For the process group id (as used for terminal job control):

ps -o pgid -p "$pid"

To store it into a variable:

pgid=$(($(ps -o pgid= -p "$pid")))

Solution 3

Using ps:

$ ps -o group,supgrp $$
GROUP    SUPGRP
muru     adm,cdrom,sudo,dip,www-data,plugdev,lpadmin,mlocate,sambashare,lxd,libvirtd,docker,muru

From man ps, the output columns used for -o:

   egid        EGID      effective group ID number of the process as a
                         decimal integer.  (alias gid).

   egroup      EGROUP    effective group ID of the process.  This will be
                         the textual group ID, if it can be obtained and
                         the field width permits, or a decimal
                         representation otherwise.  (alias group).

   gid         GID       see egid.  (alias egid).

   group       GROUP     see egroup.  (alias egroup).

   supgid      SUPGID    group ids of supplementary groups, if any.  See
                         getgroups(2).

   supgrp      SUPGRP    group names of supplementary groups, if any.  See
                         getgroups(2).

Comments

[Gilles 'SO- stop being evil']

The question is about Linux, which is not (much) derived from SVr4, so this doesn't answer the question. Also there is no such thing as “the official procfs”: each Unix variant has its own implementation of it, or doesn't have one.

[schily]

You seem to miss that there was a paper on procfs and another one on procfs-2. Linux has not much more in common with that paper than the name procfs. Since this portal is about UNIX, it is obvious that there are people who like to know how things work on UNIX even thought the question might have been Linux specific.

[Ingo Karkat]

For parsing, it's helpful to omit the output of the header; -o pgid= will do that. -p is optional and can be left out. There's still leading whitespace in the output, so do this to capture the PGID: pgid=$(ps -o pgid= "$pid" | grep -o '[0-9]\+')

[Stéphane Chazelas]

@Ingo, -p is not optional per POSIX. Neither -o nor \+ are standard either. Here, you could use pgid=$(($(ps -o pgid= -p "$pid"))) portably if you wanted to store that pid in a variable (gives 0 if $pid is not found but preserves the exit status of ps).

[Ingo Karkat]

Thanks for adding the parsing part into your answer, and for the notes on POSIX compatibility; that $((...)) evaluation is a really neat trick (and also slightly more efficient that using grep). I'm learning so much from your great answers!!!