Unlock Linux Secrets: Exploring /proc and /proc/self for Process Insight

/proc Introduction

/proc

is a pseudo (virtual) file system that stores a set of special files representing the current kernel state. Users can read these files to view hardware and process information, and can modify some to change kernel behavior. In short,

/proc

resides in memory.

The

/proc

directory contains many numeric sub‑directories whose names are the PIDs of running processes, each holding various information files for that process.

/proc/self Introduction

/proc/self

refers to the current process’s directory. While

/proc/$pid/

can be used to inspect a specific process,

/proc/self/

provides the same information without needing to know the PID, as it always points to the calling process.

How to Use /proc/self

cmdline

Get the full command line used to start the current process.

<code>cat /proc/self/cmdline</code>

The command returns the startup command of the process.

cwd

The

cwd

file is a symbolic link to the current working directory of the process.

<code>ls /proc/self/cwd</code>

exe

Show the absolute path of the executable of the current process.

<code>ls -al /proc/self/exe</code>

environ

Display the environment variables of the current process.

<code>cat /proc/self/environ</code>

maps

/proc/self/maps

lists the memory mappings of the process. Each line contains the address range, permissions, offset, device, inode and pathname. For example,

/usr/bin/cat

indicates a binary file.

mem

/proc/self/mem

represents the process’s memory image. It can be read using offsets from

/proc/self/maps

, but some regions are unmapped and cannot be read directly.