Debian 11 Bullseye pc, systemd, no display manager, startx is used to start X, multiple users.
When I login with a user, let's say auser-UID 1000, I see this on process list:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND foo 550 0.0 0.1 15280 8928 ? Ss 16:18 0:00 /lib/systemd/systemd --user foo 554 0.0 0.0 166520 2732 ? S 16:18 0:00 (sd-pam) auser 657 0.0 0.1 15280 8928 ? Ss 16:18 0:00 /lib/systemd/systemd --user auser 658 0.0 0.0 166520 2732 ? S 16:18 0:00 (sd-pam) Apparently they are related to these mounts (foo-UID 1001):
cropped mount command result:
tmpfs on /run/user/1001 type tmpfs (rw,nosuid,nodev,relatime,size=791080k,nr_inodes=197770,mode=700,uid=1001,gid=1001) tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=791080k,nr_inodes=197770,mode=700,uid=1000,gid=1000) That's prior to starting X, very few processes, nothing in my knowledge is started automatically by foo which is not logged in.
How can I locate what starts these 2 foo processes? It happens automatically at boot, there is an entry in journal:
systemd[542]: pam_unix(systemd-user:session): session opened for user foo(uid=1001) by (uid=0) There are also other local users on the system, but no tmpfs is started automatically for them.
