Unlock Linux Secrets: Exploring /proc and /proc/self Virtual Files

/proc Overview

/proc

is a virtual (pseudo) file system that stores a series of special files reflecting the kernel's current runtime state. Users can read these files to view hardware details and information about running processes, and even modify some to change kernel behavior. The /proc directory resides in memory and contains many sub‑directories named with numeric PIDs, each holding multiple information files for the corresponding process.

/proc/self Overview

/proc/self

represents the directory of the current process. Instead of first obtaining the PID and accessing /proc/<pid>, a process can directly read /proc/self to obtain its own system information, as the directory dynamically maps to the calling process's PID.

How to Use

cmdline

Retrieve the full command line used to start the current process. cat /proc/self/cmdline The command returns the startup command of the process.

cwd

The cwd file is a symbolic link pointing to the current working directory of the process.

ls /proc/self/cwd

exe

Obtain the absolute path of the executable file of the current process.

ls -al /proc/self/exe

environ

Display the environment variable information of the current process.

cat /proc/self/environ

maps

The /proc/self/maps file lists the memory mapping of the current process. Each line provides the memory region, permissions, offset, device number, inode, and path (e.g., /usr/bin/cat for a binary).

mem

The /proc/self/mem file contains the process's memory image. It cannot be read directly because some regions are unmapped; you must use the offset addresses from /proc/self/maps together with start and end parameters to read specific sections.