Unlocking Linux /proc: A Complete Guide to the Virtual Filesystem

Overview of the /proc virtual filesystem

The /proc directory is a virtual filesystem that presents kernel data structures as files and directories, allowing users to inspect and sometimes modify system attributes. It is usually auto‑mounted at /proc, but can be mounted manually: mount -t proc proc /proc Most entries under /proc are read‑only; a few are writable and can be used to change kernel configuration for the owning process.

Key directories

/proc/pid

Each running process has a subdirectory named by its PID. This directory mirrors the process’s state and contains many files and subdirectories that expose information such as command line, environment, memory maps, open file descriptors, and security attributes. Example:

ls -al /proc/1234

/proc/tid

Thread‑specific information is available under /proc/pid/task/tid. Although the /proc/tid path is not directly visible with ls, you can enter a thread’s view with: cd /proc/1234/task/5678 Traditional tools like ps | grep tid cannot see this; use ps -T -p pid instead.

/proc/self and /proc/thread-self

/proc/self

is a symlink to the calling process’s /proc/[pid] directory, and /proc/thread-self points to /proc/self/task/[tid]. They provide a convenient way for a process to refer to its own files.

Important /proc/pid files

/proc/pid/attr

This directory offers an API for security modules (e.g., SELinux). Files include:

current : current security context of the process.

exec : security attributes applied on execve.

fscreate : permissions for file creation operations.

keycreate : security context for key creation.

prev : previous security context before the last execve.

socketcreate : context for newly created sockets.

/proc/pid/autogroup

Related to scheduling; see sched(7) for details.

/proc/pid/auxv

Contains ELF auxiliary vector entries passed to the process at startup. See getauxval(3) for interpretation.

/proc/pid/cgroup

Shows cgroup membership; see cgroups(7).

/proc/pid/clear_refs

A write‑only file that can reset various page‑reference flags. Accepted values depend on kernel version (e.g., resetting PG_Referenced, soft‑dirty bits, or peak resident size). Only the process owner may write to it.

/proc/pid/cmdline

Read‑only file containing the full command line of the process. Empty for zombie processes.

/proc/pid/comm

Stores the short command name (up to 16 bytes). It can be read or set via prctl(PR_SET_NAME) or pthread_setname_np(3). Example to view:

cat /proc/1234/comm

/proc/pid/coredump_filter

Controls which memory regions are included in core dumps; see core(5).

/proc/pid/cwd

Symlink to the process’s current working directory. To display it: ls -al /proc/1234/cwd In a multithreaded program, if the main thread exits, this link may become inaccessible.

/proc/pid/environ

Shows the environment variables of the process, with entries separated by null bytes. Example to list them line‑by‑line: cat /proc/1234/environ | tr '\000' '\n' Changes made via putenv(3) or environ(7) after execve are not reflected here; the location can be altered with prctl(PR_SET_MM_ENV_START).

/proc/pid/exe

Symlink to the executable binary of the process. It can be read with readlink or even executed again by invoking the link.

/proc/pid/fd and /proc/pid/fdinfo

/proc/pid/fd

contains symbolic links for each open file descriptor (0 = stdin, 1 = stdout, 2 = stderr). Example:

ls -l /proc/1234/fd

/proc/pid/fdinfo/FD

provides details such as file offset and flags. Example: cat /proc/1234/fdinfo/99 pos : decimal file offset.

flags : octal representation of access mode and status flags.

/proc/pid/limits

Shows resource limits (soft and hard) for the process. Accessible to all users on kernels ≥ 2.6.36.

/proc/pid/maps

Lists memory regions mapped into the process address space, with permissions, offsets, device IDs, inode numbers, and pathnames.

/proc/pid/mem

Provides raw access to the process’s memory via open, read, and seek.

/proc/pid/mountinfo, /proc/pid/mounts, /proc/pid/mountstas

These files describe mount points visible to the process, including IDs, parent IDs, device numbers, mount options, filesystem type, and source. Example line from mountinfo:

36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue

/proc/pid/ns/*

Namespace handles that can be opened and passed to setns(2) to enter another process’s IPC, network, or UTS namespace.

/proc/pid/numa_maps

NUMA memory allocation information; see numa(7).

/proc/pid/oom_adj, /proc/pid/oom_score, /proc/pid/oom_adj_score

Influence the OOM killer’s decision. Values range from –17 (protect) to 15 (more likely to be killed). Newer kernels prefer /proc/[pid]/oom_score_adj.

/proc/pid/root

Symlink to the process’s root directory, used by chroot. In multithreaded programs, it becomes inaccessible if the main thread exits.

/proc/pid/smaps

Provides detailed memory consumption per mapping, including size, RSS, shared/dirty pages. Only present when the kernel is built with CONFIG_MMU.

/proc/pid/stat and /proc/pid/statm

Contain low‑level numeric process statistics used by tools like ps. statm gives memory usage breakdown (size, resident, shared, text, lib, data, dirty).

/proc/pid/status

Human‑readable version of stat and statm, showing fields such as Name, State, Uid, Gid, VmSize, VmRSS, Threads, and capability masks. Example excerpt:

Name:	bash
State:	S (sleeping)
Pid:	3515
Uid:	1000	1000	1000	1000
Gid:	100	100	100	100
VmSize:	7896 kB
VmRSS:	6316 kB
Threads:	1

/proc/pid/task

Contains a subdirectory for each thread (named by TID). The layout under each task/TID mirrors that of /proc/pid, sharing common attributes like the working directory while exposing thread‑specific values.

/proc/cmdline

Kernel command‑line parameters passed at boot.

/proc/cpuinfo

CPU and architecture details (model, cores, cache, flags).

/proc/meminfo

Current memory usage statistics (total, free, buffers, cached, swap, etc.).

/proc/modules

List of currently loaded kernel modules.

/proc/net/*

Various network‑related virtual files providing information on interfaces, routing, sockets, ARP tables, and protocol statistics. Example /proc/net/arp entry:

IP address     HW type   Flags     HW address          Mask   Device
192.168.0.50   0x1       0x2       00:50:BF:25:68:F3   *      eth0

/proc/stat

System‑wide kernel statistics such as CPU time distribution and interrupts.

/proc/sys

Configuration interface for many kernel parameters (e.g., networking, virtual memory). Changes take effect immediately.

Practical command examples

# Mount /proc manually
mount -t proc proc /proc

# Show the current process’s working directory
ls -al /proc/$$/cwd

# Display environment variables line by line
cat /proc/$$/environ | tr '\000' '
'

# Inspect file descriptor information
cat /proc/$$/fdinfo/0

# View detailed status of the current shell
cat /proc/$$/status

These commands illustrate how to explore the virtual filesystem and retrieve low‑level information about processes, memory, mounts, and kernel settings.