# proc

## NAME



           proc - process information, system information, and sysctl pseudo-
           filesystem
    


## DESCRIPTION



           The **proc** filesystem is a pseudo-filesystem which provides an
           interface to kernel data structures.  It is commonly mounted at
           _/proc_.  Typically, it is mounted automatically by the system, but
           it can also be mounted manually using a command such as:
    
               mount -t proc proc /proc
    
           Most of the files in the **proc** filesystem are read-only, but some
           files are writable, allowing kernel variables to be changed.
    
       **Mount options**
           The **proc** filesystem supports the following mount options:
    
           **hidepid=**_n_ (since Linux 3.3)
                  This option controls who can access the information in
                  _/proc/_ pid directories.  The argument, _n_ , is one of the
                  following values:
    
                  0   Everybody may access all _/proc/_ pid directories.  This
                      is the traditional behavior, and the default if this
                      mount option is not specified.
    
                  1   Users may not access files and subdirectories inside
                      any _/proc/_ pid directories but their own (the _/proc/_ pid
                      directories themselves remain visible).  Sensitive
                      files such as _/proc/_ pid _/cmdline_ and _/proc/_ pid _/status_
                      are now protected against other users.  This makes it
                      impossible to learn whether any user is running a
                      specific program (so long as the program doesn't
                      otherwise reveal itself by its behavior).
    
                  2   As for mode 1, but in addition the _/proc/_ pid
                      directories belonging to other users become invisible.
                      This means that _/proc/_ pid entries can no longer be used
                      to discover the PIDs on the system.  This doesn't hide
                      the fact that a process with a specific PID value
                      exists (it can be learned by other means, for example,
                      by "kill -0 $PID"), but it hides a process's UID and
                      GID, which could otherwise be learned by employing
                      stat(2) on a _/proc/_ pid directory.  This greatly
                      complicates an attacker's task of gathering information
                      about running processes (e.g., discovering whether some
                      daemon is running with elevated privileges, whether
                      another user is running some sensitive program, whether
                      other users are running any program at all, and so on).
    
                  **gid=**_gid_ (since Linux 3.3)
                      Specifies the ID of a group whose members are
                      authorized to learn process information otherwise
                      prohibited by **hidepid**(i.e., users in this group behave
                      as though _/proc_ was mounted with _hidepid=0_).  This
                      group should be used instead of approaches such as
                      putting nonroot users into the sudoers(5) file.
    
           **subset=pid**(since Linux 5.8)
                  Show only the specified subset of procfs, hiding all top
                  level files and directories in the procfs that are not
                  related to tasks.
    
       **Overview**
           Underneath _/proc_ , there are the following general groups of files
           and subdirectories:
    
           _/proc/_ pid subdirectories
                  Each one of these subdirectories contains files and
                  subdirectories exposing information about the process with
                  the corresponding process ID.
    
                  Underneath each of the _/proc/_ pid directories, a _task_
                  subdirectory contains subdirectories of the form _task/_ tid,
                  which contain corresponding information about each of the
                  threads in the process, where _tid_ is the kernel thread ID
                  of the thread.
    
                  The _/proc/_ pid subdirectories are visible when iterating
                  through _/proc_ with getdents(2) (and thus are visible when
                  one uses ls(1) to view the contents of _/proc_).
    
           _/proc/_ tid subdirectories
                  Each one of these subdirectories contains files and
                  subdirectories exposing information about the thread with
                  the corresponding thread ID.  The contents of these
                  directories are the same as the corresponding
                  _/proc/_ pid _/task/_ tid directories.
    
                  The _/proc/_ tid subdirectories are _not_ visible when iterating
                  through _/proc_ with getdents(2) (and thus are _not_ visible
                  when one uses ls(1) to view the contents of _/proc_).
    
           _/proc/self_
                  When a process accesses this magic symbolic link, it
                  resolves to the process's own _/proc/_ pid directory.
    
           _/proc/thread-self_
                  When a thread accesses this magic symbolic link, it
                  resolves to the process's own _/proc/self/task/_ tid
                  directory.
    
           _/proc/[a-z]*_
                  Various other files and subdirectories under _/proc_ expose
                  system-wide information.
    
           All of the above are described in more detail in separate manpages
           whose names start with **proc_**.
    


## NOTES



           Many files contain strings (e.g., the environment and command
           line) that are in the internal format, with subfields terminated
           by null bytes ('\0').  When inspecting such files, you may find
           that the results are more readable if you use a command of the
           following form to display them:
    
               $ **cat** _file_ **| tr '\000' '\n'**
    


* * *