今天在使用lsof查找那些进程使用libwrap的时候发现结果如下
>>> lsof | grep libwrap
...
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
lsof: no pwd entry for UID 33
sshd 5915 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
sshd 9512 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
之所以出现大量‘lsof: no pwd entry for UID 33’的情况,原因有二:
- 进程在用户被删除之前启动,并且从那以后一直在运行;
- 进程在容器内被启动
查看后发现UID 33的进程仅有nginx的worker进程,而这台服务器的nginx只在容器内启动,所以应该是第二个原因导致的。
>>> ps -ef | grep 33
...
33 4334 4333 0 Feb07 ? 00:00:00 nginx: worker process
33 4335 4333 0 Feb07 ? 00:00:00 nginx: worker process
...
但为什么会出现这么多条‘lsof: no pwd entry for UID 33’,原因还未可知。
使用’-w’参数可以过滤掉这些信息
>>> lsof -w | grep libwrap
auditd 464 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
auditd 464 465 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
sshd 5915 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
sshd 9512 root mem REG 253,1 42520 1054255 /usr/lib64/libwrap.so.0.7.6
参考:
https://www.cnblogs.com/diyunpeng/archive/2012/06/30/2571307.html
https://unix.stackexchange.com/questions/193911/lsof-no-pwd-entry-for-uid#:~:text=Can%20also%20be,%E2%80%93%C2%A0