Why is the reported user “root” when a “normal user” executes “ps ux” on OS X? Is this normal behaviour?

Question

I am running OS X 10.6.1 . When i am logged in as a normal user of group staff and do a

ps ux

it lists my ps ux command as being run by root:

snies   181   0.0  0.3  2774328  12500   ??  S     6:00PM   0:20.96 /System/Library...
root   1673   0.0  0.0  2434788    508 s001  R+    8:16AM   0:00.00 ps ux
snies   177   0.0  0.0  2457208    984   ??  Ss    6:00PM   0:00.52 /sbin/launchd
snies  1638   0.0  0.0  2435468   1064 s001  S     8:13AM   0:00.03 -bash

Is this normal behaviour? And if so why? Please note that the user is not an Administrator account and is not able to sudo.

Answer 1

It is normal for Mac OS X. It used to be normal on almost all Unix-oid systems. It runs as root without sudo because the ps binary is set-uid to run as root (e.g. on my 10.4 system):

% ls -l $(which ps)
-rwsr-xr-x   1 root  wheel  31932 Mar 20  2005 /bin/ps

(the s in place of the the user-owner x column means that it is set-uid (and user-executable), the owner is root; this means that no matter who runs it, it will run as root)

Traditionally (and still the case on Mac OS X systems), it must run as root because the information it needs is only available via root-accessible devices (e.g. /dev/kmem) or root-only system calls. This is OK because (unless there are bugs in the implementation) the ps program is written in a way that does not let callers get information that they should not otherwise have.

Other systems have other mechanisms that provide access to the info that ps needs and thus do not need set-uid ps binaries. Notably, the /proc virtual filesystem on Linux systems (and others) can publish very fine grained kernel information with equally fine grained permissions. Such a model is sufficient to allow a non-privileged ps to get everything it needs without allowing access to the more sensitive bits of kernel information.