Unit 6: Processes and services · Lesson 2 of 6 · 16 min
Looking inside /proc
Every process has a folder in /proc. Read its name, parent, owner and command line.
mission
- You are
- You are looking closer at dana's processes.
- Situation
- Two processes run as dana. ps gives you names, but you want the details the kernel keeps.
- Goal
- Read the status and command line of dana's processes from /proc.
- Hand in
- The parent, owner and full command line of the process named kthreadd.
What /proc/PID holds
- statusName, state, parent and owner
- cmdlineThe full command line
- exeA link to the real program on disk
- environVariables, readable only by the owner
Find dana's processes
pgrep -l -u dana
11 kthreadd
12 sync-agent
you should see Process IDs differ between machines. Use the ones your lab shows.
Read the status file
/proc/PID/status is the kernel's own record. Uid shows the real owner, PPid the parent.
P=$(pgrep -u dana kthreadd) grep -E '^(Name|State|PPid|Uid)' /proc/$P/status Name: kthreadd State: S (sleeping) PPid: 1 Uid: 1001 1001 1001 1001
Read the command line
The command line is separated by null bytes. tr turns them into spaces.
tr '\0' ' ' < /proc/$P/cmdline; echo [kworker/0:2] infinity ls -l /proc/$P/exe ls: cannot read symbolic link '/proc/11/exe': Permission denied lrwxrwxrwx 1 dana dana 0 Oct 22 12:03 /proc/11/exe
you should see The name says kthreadd, the command line says kworker. Only dana or root can see which file it really runs.
defender tip On a real incident, root would read /proc/PID/exe and copy the binary out before anything else.
Useful files in /proc/PID
| Command | What it does |
|---|---|
status | Name, state, parent, owner, memory |
cmdline | The full command line |
exe | Link to the program file |
cwd | Link to its working directory |
What a defender takes away
- 1/proc has a folder per process.
- 2status and cmdline are readable by everyone.
- 3exe and cwd are private to the owner and root.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.