Ssh – Why would pgrep not show the processes but sudo pgrep does

processpsssh-agent

I looked at a list of processes and filtered out ssh-agent which correctly shows the 3 processes I expected:

$ ps -ef | grep ssh-agent
belmin   1051     1  0 16:05 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   2569     1  0 16:09 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   2655     1  0 16:09 ?        00:00:00 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
belmin   5093  2596  0 16:17 pts/1    00:00:00 grep --color ssh-agent

However, if I perform a pgrep, it doesn't list the 3 processes unless I escalate to sudo:

$ pgrep -a ssh-agent

$ sudo !!
sudo pgrep -a ssh-agent
1051 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
2569 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
2655 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple

Initially, I thought it was because PPID is 1. However, this isn't a problem with other processes that have PPID as 1 so that's not it.

What am I missing here?

Update:

So apparently applying namespace argument (--ns) works without sudo—regardless of what namespace I provide:

$ for n in 'ipc' 'mnt' 'net' 'pid' 'user' 'uts'; do echo pgrep -a --ns $n ssh-agent; pgrep -a --ns $n ssh-agent; done
    pgrep -a --ns ipc ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns mnt ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns net ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns pid ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns user ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple
    pgrep -a --ns uts ssh-agent
    12986 ssh-agent -a /home/belmin/.ssh/.auth_sock.pineapple

Still unclear as to why. I'll keep digging.

Best Answer

Procps 3.3.13 had pgrep filter on namespaces. Mainly so pkill doesn't kill outside it's namespace. However for some processes, especially around SSH for some reason, it gives odd results.

3.3.14 has this change reverted.

Related Question