Process VFS

The process virtual filesystem, or procfs, is mounted at /proc by the kernel during early boot. It allows us to query data about running processes.

  • /proc is its root.
    • cmdline contains the booted kernel command line.
    • cpuinfo lists CPU cores along with stepping, instruction set, and version data.
    • meminfo details memory consumption and availability.
    • mounts lists mounted filesystems.
    • version details kernel build information.
    • $pid/:
      • cmdline contains the command line used to launch the process.
      • cwd is a symbolic link to the current working directory of the process.
      • environ lists environment variable key-value pairs (null-terminated).
      • exe is a link to the executable.
      • fd/ contains links to files with open file descriptors.
        • 0 is STDIN.
        • 1 is STDOUT.
        • 2 is STDERR.
        • *
      • fdinfo/ contains files describing the open file descriptors.
      • limits describe process soft and hard limits (managed with ulimit).
      • /maps describes mapped memory regions.
      • /mem allows raw access to the virtual memory, and is accessible only via ptrace.
      • ns/
        • * (e.g. cgroup, net) contains a link to each process's namespaces, with the filename representing the namespace type.
      • /root is a symbolic link to the root path the process sees (which may be a chroot).
      • /status describes the processes's state.
      • /task contains hard links to any started tasks.