difference between tty[p,r,s][N] and pts

Question

$ ps -ef | grep tty | grep root | grep "-sh"
root 25185 25184  0  Oct 14  ttyp4     0:00 -sh
root 22998 22997  0  Oct 14  ttyp2     0:00 -sh
root 25379 25378  0  Oct 13  ttyp0     0:00 -sh
root  1709  1708  0  Oct 13  ttyrf     0:00 -sh
root 27558 27552  0  Oct 14  ttyp5     0:00 -sh
root 28955 28954  0  Oct  1  ttys5     0:00 -sh
root 12124 12123  0  Oct 13  ttyq9     0:00 -sh
root 16255 16254  0  Oct  8  ttys8     0:00 -sh
root 13731 13729  0  Oct 13  ttyq1     0:00 -sh
root 24695 24694  0  Oct  8  ttys9     0:00 -sh
root 26969 26968  0  Oct  7  ttys7     0:00 -sh
root  3625  3624  0  Oct 15  ttyp6     0:00 -sh
root 22387 22385  0  Oct 13  ttys0     0:00 -sh
root  7946  7945  0  Oct  8  ttysb     0:00 -sh
root  1071  1070  0  Oct  1  ttys6     0:00 -sh

when I log in using SSH I get pts/1 let's saybut I do not understand why there are those root ttys[N]. Somewhere on google I found that it is equivalent to pts but the second question, why two different names for pseudoterminal? And the third question is for the command part of the ps output, is it just a pseudoterminal for sh (shell)?

Answer 1

OS X, like other UNIX-iod systems, implements two systems of pseudo-terminals: the pty system and the ptmx system (links are to the kernel source used in 10.9.5).

They both ultimately offer the same functionality: they let one program (e.g. a terminal emulator) open (the master side of) a pseudo-terminal and subsequently start other programs (e.g. a shell) running “in” (the slave side of) that same pseudo-terminal.

The pty system is older. The device nodes for the master sides of its pseudo-terminals match the pattern /dev/pty[pqrstuvw][0123456789abcdef]. The slave sides use corresponding nodes named with tty (/dev/tty[pqrstuvw][0123456789abcdef]). These device nodes are allocated when the system starts (i.e. they are always present in /dev/).

The ptmx system is newer and uses a single master device node, /dev/ptmx, and uses /dev/ttys[0-9][0-9][0-9] for the slave sides. The slaves device nodes are dynamically allocated (so only the nodes that are still in use exist in /dev/).

Basically, any program that uses the “modern” pseudo-terminal APIs will automatically end up using ptmx-based pseudo-terminals. Programs using the older pseduo-terminal interfaces will use pty-based pseudo-terminals.

---

In your case, when spawning its children, your sshd used the newer ptmx system (or an interface like openpty that uses it “under the hood”), but the pertinent ancestor of those root shells used the old pty system. If you are curious, you could trace the parent PIDs (PPID, the third column in your output) to find the ancestor program that spawned the line of processes that ended up running those root shells (the leading hyphen indicates that they are login shells).

Also, other systems may use variations on the device names. Some systems might go beyond 0–f for the pty names, and some systems use /dev/pts/<digits> (i.e. in a subdirectory instead of putting them all in /dev and having to use three digits to avoid conflict with the ttys0–ttys9 slave nodes from the pty system).