[discuss] What is process.owner in POSIX?

[mjwolf]

The process.owner attribute is defined as "The username of the user that owns the process". What does that mean for POSIX systems?

In Windows, a process's owner is well-defined, but POSIX doesn't have a well-defined process "owner". To me, with POSIX, the owner could be one of: the user that owns the file being executed, effective user ID, real user ID, or (maybe) saved user ID.

I think it should be decided what process.owner means with POSIX systems, and add a note to the attribute to better define it.

I think it could either specify that process.owner should only be used on Windows, and use other attributes with POSIX (other process user ID attributes will be added with #564), or define which value should be used with POSIX.

[trisch-me]

In your note for the process PR you mentioned

This is intended to be used with Windows only. On POSIX systems, processes can have multiple users (effective, real and saved). To avoid confusion about which user is being referenced, this field should not be used with POSIX systems.

I think the problem here is that this field will be empty. Does it make sense and is there a way to copy to the owner one of the users (effective, real or saved) for POSIX systems?

[mjwolf]

I think the problem here is that this field will be empty. Does it make sense and is there a way to copy to the owner one of the users (effective, real or saved) for POSIX systems?

Could this be set as recommended or opt_in requirement level, and leave it empty on posix systems? (I'm not sure of the difference between these)

When I see "owner" in Linux, I think of file ownership, and when I first looked at this attribute, I thought it was referring to "the owner of the file being executed". But the ECS file.owner attribute will be better for this, when it's added to otel. And fileless process executions are possible with memfd, so this might not be present at all.

"Effective user ID's username" is probably the closest to the Windows process owner. But that will already be the process.user.name attribute, and I don't see why it would need to be duplicated.

People who are not too familiar with Windows might think of these before they think of the Windows definition, so that's why I thought it would be a good idea to add a note that the attribute is Windows-only and avoid possible confusion about the usage. If it can't be Windows-only, I think we should define which of these definitions should be used on posix