why operation not permitted when kill a nonexistent process and why need to be killed with sudo

Question

Linux version: CentOS 7

[weizhong@bja /tmp]
$ll apis_response_time_analysis.pid 
-rw-r--r-- 1 weizhong users 5 Jan 22 09:40 apis_response_time_analysis.pid

[weizhong@bja /tmp]
$cat apis_response_time_analysis.pid 
20795

[weizhong@bja /tmp]
$sudo ps -ef | grep 20795
weizhon+ 24876  9196  0 11:41 pts/2    00:00:00 grep --color=auto 20795

I can't find the PID, then I've tried to kill it by my account. However, it saied Operation not permitted instead of No such process

[weizhong@bja /tmp]
$kill -9 20795
-bash: kill: (20795) - Operation not permitted

[weizhong@bja /tmp]
$kill -9 20795123   <--- a pid not exists
-bash: kill: (20795123) - No such process

then I tried to kill it with sudo, I've executed

[weizhong@bja /tmp]
$sudo kill 20795    <-- no output

[weizhong@bja /tmp]
$sudo kill -9 20795
kill: sending signal to 20795 failed: No such process

Then I executed by my account again

[weizhong@bja /tmp]
$kill 20795
-bash: kill: (20795) - No such process

I'm sure that pid 20795 is generated by my account. Currently I can't find 20795, but when I kill it, return Operation not permitted instead of No such process, I wanna know why, and why my process need to be killed by sudo

Solution 1

You are not the owner of the process you are trying to kill. This is the reason for both ps output — which did not list process 20795 (see @kamil-maciorowski answer) — and the sudo requirement to kill 20795.

You can use ps aux to list all processes including those you don't own. You can also use -p argument to show a specific process which best fit your need:

ps -up 20795

You will see something like this:

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
foo      20795  0.0  0.0  14728  1888 tty3     Ss+  12:03   0:00 bar

My guess is that user will be root (elevated privileges) or maybe another specific system user. You then need sudo to kill a process you don't own. And you succeed to kill it. The empty answer for sudo kill 20795 tells it worked.

Solution 2

Notice your ps -ef | grep 20795 returned the grep itself only – the match was with the command line, not the PID. There was no process with the PID you specified.

My guess is the number may have been incorrect. It probably matched somebody else's thread ID and this way sudo kill killed somebody else's entire process which was not what you wanted.

Comments

[AFH]

In Ubuntu ps -ef gives the same listing regardless of sudo. It looks like PID 20795 was free at the time you performed the grep, but was then allocated to another process. Or it could have been a thread ID, but I don't know what kill does with TIDs.