3
$ ps -ef | grep tty | grep root | grep "-sh"
root 25185 25184  0  Oct 14  ttyp4     0:00 -sh
root 22998 22997  0  Oct 14  ttyp2     0:00 -sh
root 25379 25378  0  Oct 13  ttyp0     0:00 -sh
root  1709  1708  0  Oct 13  ttyrf     0:00 -sh
root 27558 27552  0  Oct 14  ttyp5     0:00 -sh
root 28955 28954  0  Oct  1  ttys5     0:00 -sh
root 12124 12123  0  Oct 13  ttyq9     0:00 -sh
root 16255 16254  0  Oct  8  ttys8     0:00 -sh
root 13731 13729  0  Oct 13  ttyq1     0:00 -sh
root 24695 24694  0  Oct  8  ttys9     0:00 -sh
root 26969 26968  0  Oct  7  ttys7     0:00 -sh
root  3625  3624  0  Oct 15  ttyp6     0:00 -sh
root 22387 22385  0  Oct 13  ttys0     0:00 -sh
root  7946  7945  0  Oct  8  ttysb     0:00 -sh
root  1071  1070  0  Oct  1  ttys6     0:00 -sh

when I log in using SSH I get pts/1 let's saybut I do not understand why there are those root ttys[N]. Somewhere on google I found that it is equivalent to pts but the second question, why two different names for pseudoterminal? And the third question is for the command part of the ps output, is it just a pseudoterminal for sh (shell)?

1 Answer 1

5

OS X, like other UNIX-iod systems, implements two systems of pseudo-terminals: the pty system and the ptmx system (links are to the kernel source used in 10.9.5).

They both ultimately offer the same functionality: they let one program (e.g. a terminal emulator) open (the master side of) a pseudo-terminal and subsequently start other programs (e.g. a shell) running “in” (the slave side of) that same pseudo-terminal.

The pty system is older. The device nodes for the master sides of its pseudo-terminals match the pattern /dev/pty[pqrstuvw][0123456789abcdef]. The slave sides use corresponding nodes named with tty (/dev/tty[pqrstuvw][0123456789abcdef]). These device nodes are allocated when the system starts (i.e. they are always present in /dev/).

The ptmx system is newer and uses a single master device node, /dev/ptmx, and uses /dev/ttys[0-9][0-9][0-9] for the slave sides. The slaves device nodes are dynamically allocated (so only the nodes that are still in use exist in /dev/).

Basically, any program that uses the “modern” pseudo-terminal APIs will automatically end up using ptmx-based pseudo-terminals. Programs using the older pseduo-terminal interfaces will use pty-based pseudo-terminals.


In your case, when spawning its children, your sshd used the newer ptmx system (or an interface like openpty that uses it “under the hood”), but the pertinent ancestor of those root shells used the old pty system. If you are curious, you could trace the parent PIDs (PPID, the third column in your output) to find the ancestor program that spawned the line of processes that ended up running those root shells (the leading hyphen indicates that they are login shells).

Also, other systems may use variations on the device names. Some systems might go beyond 0–f for the pty names, and some systems use /dev/pts/<digits> (i.e. in a subdirectory instead of putting them all in /dev and having to use three digits to avoid conflict with the ttys0ttys9 slave nodes from the pty system).

4
  • Thanks for great explanation! Number of those old pty’s which are pre-allocated can be increased? Regarding the hyphen which indicates that those terminals are login shells, is it possible to identify which are already dead? If some of those terminals were using nohup I would probably see it in command column of “ps -ef” output. Problem I am facing in the Unix is that for unkown reason dead terminals are not closed so I am trying to identify the reason. Commented Oct 24, 2014 at 20:56
  • It looks like the number of old-style ptys is fixed when the kernel is compiled. I would guess that the reason those interactive shells are still around is that whatever opened the master side of the pty still has it open (i.e. the shell thinks that there still might be more input at some point in the future). Look for the nearest ancestor process that has a different (or no) tty. I tested Terminal, iTerm 2, xterm, tmux, screen, script, and expect (on my 10.9.5 system), but none of them use the old-style ptys (they all ended up with ptmx-based ttys). Commented Oct 24, 2014 at 23:59
  • Thanks a lot! The macOS-specific ptmx system isn’t documented anywhere: there is no man ptmx on macOS; the only clue is the last few lines of /etc/ttys saying nothing more than “cloning ptys”. This answer is pretty much the most reliable source. Commented Jan 5, 2023 at 7:28
  • Is ptmx on macOS the same thing as its posix_openpt() implementation? Commented Jan 5, 2023 at 7:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .