Linux – How to Find What Ring a Process is Running On

64bitlinuxprivilegesprocess

How can I find out which protection ring a given process is running in, and if possible can I produce a list of running processes with their respective rings? This thread gives some insight into what rings are utilised on an x86 processor: https://stackoverflow.com/questions/18717016/what-are-ring-0-and-ring-3-in-the-context-of-operating-systems

I would like to know how to find out what protection ring level processes are running in myself, not be given a description of what rings processes will be running in (although you can include it if you want).

Best Answer

On x86, the current privilege level is determined by the bottom two bits of the code segment selector, i.e. the value stored in the CS register. So "all" you need to do to determine the current privilege level of a process is look at the value of its CS register.

You can do that quite easily for your own program (assuming 64-bit x86):

#include <stdint.h>
#include <stdio.h>

int main (int argc, char **argv) {
    uint64_t rcs = 0;
    asm ("mov %%cs, %0" : "=r" (rcs));
    printf("%d\n", (int) (rcs & 3));
    return 0;
}

For other processes, you'd have to attach to them using something like ptrace, and examine their registers. You can do this manually using gdb: identify a process, attach to it (if you're allowed to) using gdb --pid ..., then issue the gdb command info registers cs to see the current value of CS, and extract the value of the least-significant two bits.

On Linux on x86 you'll quickly see that the current privilege level is always 3: user processes always run in ring 3, except when they’re in system calls (which run in ring 0) — but you won’t be able to see them in ring 0 externally, except by tracing kernel code using ftrace for example.

Related Question