How to find the real owner of a process after su

Question

We have a convention whereby developers get into a server with their own username, and then sudo su - django where django is the user our apps run under.

I need to find out which developer is running a script as django. With ps faux :

root     26438  0.0  0.0  90152  3320 ?        Ss   10:38   0:00  \_ sshd: fred [priv]
fred     26444  0.0  0.0  90152  1852 ?        S    10:38   0:00  |   \_ sshd:         fred@pts/0
fred     26445  0.0  0.0  66052  1560 pts/0    Ss   10:38   0:00  |       \_ -bash
root     27923  0.0  0.0 101052  1336 pts/0    S    10:46   0:00  |           \_ su -    django
django   27924  0.0  0.0  66188  1752 pts/0    S    10:46   0:00  |               \_ -   bash
django   31760  0.0  0.5 227028 42320 pts/0    S+   11:10   0:01  |                   \_     python target_script.py

I can easily see what fred is up to. However I need to write a script to act on this info, and I can find no way to pull out "fred" and "target_script.py" in one line with ps ... euser,ruser,suser,fuser all say "django." Will I need to fumble through this ps faux output to get the info I need?

Answer 1

You used su - django. The " - " will make the new shell a login shell (see manpage of su), which let the child process forget its parent uids. That's why euser,ruser,suser,fuser all say "django".

So yes, you may have to fumble through the parent process id, or through "ps faux".