Shows last user instead of un-associated uid

[JaredNeil]

If a process is running with an un-associated uid (like 9999), the User field for that process will show the username for the last user instead of displaying the uid directly.

ps:

$ ps -o pid,user 2872
  PID USER
 2872 9999

htop:

  PID USER
 2872 9999

bb:

  PID  PPID    USER
 2872  2843  hbrown

$ tail -n 1 /etc/passwd
hbrown:x:6543:6543:<omitted>

[epilys]

This seems to be the default behavior of the getpwuid(3) functions in glibc, weird. We can see what ps is doing to fetch the usernames and follow that.