Unlock Linux Secrets: Exploring /proc and /proc/self for Process Insight

/proc Introduction

/proc

is a pseudo (virtual) file system that stores a set of special files representing the current kernel state. Users can read these files to view hardware and process information, and can modify some to change kernel behavior. In short, /proc resides in memory.

The /proc directory contains many numeric sub‑directories whose names are the PIDs of running processes, each holding various information files for that process.

/proc/self Introduction

/proc/self

refers to the current process’s directory. While /proc/$pid/ can be used to inspect a specific process, /proc/self/ provides the same information without needing to know the PID, as it always points to the calling process.

How to Use /proc/self

cmdline

Get the full command line used to start the current process. cat /proc/self/cmdline The command returns the startup command of the process.

cwd

The cwd file is a symbolic link to the current working directory of the process.

ls /proc/self/cwd

exe

Show the absolute path of the executable of the current process.

ls -al /proc/self/exe

environ

Display the environment variables of the current process.

cat /proc/self/environ

maps

/proc/self/maps

lists the memory mappings of the process. Each line contains the address range, permissions, offset, device, inode and pathname. For example, /usr/bin/cat indicates a binary file.

mem

/proc/self/mem

represents the process’s memory image. It can be read using offsets from /proc/self/maps, but some regions are unmapped and cannot be read directly.