Skip to content

Instantly share code, notes, and snippets.

@jrelo
Created January 1, 2019 14:18
Show Gist options
  • Save jrelo/e7b586cdfd9ed665256c6f65d9807292 to your computer and use it in GitHub Desktop.
Save jrelo/e7b586cdfd9ed665256c6f65d9807292 to your computer and use it in GitHub Desktop.
find procs with ruid not 0 and euid 0
find /proc/ -maxdepth 1 -user root -type d |egrep '[0-9]'|while read ; do head -1 $REPLY/cmdline;done
egrep 'Uid:' /proc/*/status|awk '{if ($3 != '0' && $2 == '0') print $0}'
egrep 'Uid:' /proc/*/status|awk '{if ($3 != '0' && $2 == '0') print $0}'|cut -d\/ -f3|while read pid;do ps -p $pid -o comm,user,pid,ppid,uid,euid,ruid,suid,lwp,nlwp,etime,time,ni,pri_foo,sgi_p,psr,stat,wchan=WIDE-WCHAN-COLUMN,min_flt,maj_flt,cls,f,pcpu,pmem,rss,vsz,sz,args;done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment