-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
<big snip>
Why "slash": /.thunderbird in case of your example? Because if you do not specify absolute path beginning with / the ssh daemon prepends your relative path with its `pwd` it runs in, and its `pwd` is "/")
Not so. Consider:
$ ssh pi-1 pwd /home/jmr
If you examine what is happening, the daemon creates an unprivileged process for the user, and that process performs the operation. Were it to be otherwise you would have a gaping hole in security.
$ ssh pi-1 ps -f UID PID PPID C STIME TTY TIME CMD jmr 3054 3050 0 04:22 ? 00:00:00 sshd: jmr@notty jmr 3055 3054 0 04:22 ? 00:00:00 ps -f $ ssh pi-1 ps -ef | grep ssh root 2432 1 0 Feb28 ? 00:00:00 /usr/sbin/sshd root 3056 2432 0 04:23 ? 00:00:00 sshd: jmr [priv] jmr 3060 3056 0 04:23 ? 00:00:00 sshd: jmr@notty
The first command shows the unprivileged process shelling out the ps command as expected. Note that the parent daemon is running as jmr@notty. The second command shows master daemon, the privileged child to handle the connection and the unprivileged jmr@notty.