Read procfs as documented views of a changing process

Fri, 29 Oct 2027 00:00:00 +0000

Linux procfs exposes process and kernel information through filesystem interfaces. Many entries generate their contents when read instead of storing ordinary disk-file bytes. Each entry has a documented meaning, permission model, and format. Reading several entries does not freeze the process or create a transactionally consistent snapshot, so useful observations must be tied to the right process instance and interpretation.

A successful readlink does not guarantee a successful open through that link. Linux separately checks the referenced inode’s permissions. Conversely, inspecting a descriptor does not consume its owner’s data merely by reading the link text. Distinguish inspecting metadata from opening and reading the referenced object, especially for pipes and other stateful streams.

Each procfs entry is a documented, permission-checked view. Read times, process identity, entry-specific parsing and object lifetime determine what the observation can establish.

When it breaks

Ordinary file assumptions can fail immediately. A proc entry can report size zero yet return useful content when read. A per-process directory can disappear as the process exits, and a numerical PID can eventually identify another instance. Treating a failed read as proof of a broken installation, or assuming a PID forever names one workload, can misdiagnose normal lifecycle changes.

Formats require entry-specific parsing. status contains labeled fields, while stat uses a positional layout with a parenthesized command name that can contain spaces and closing parentheses. Splitting the whole stat line on whitespace can shift the expected fields. cmdline and environ use NUL separators, so ordinary line or space splitting loses argument and value boundaries.

The views also have semantic limits. environ describes the environment region established at program execution, not a guaranteed live dictionary of every later environment change. Command-line contents can be changed by the process. A descriptor link ending in (deleted) does not mean the open object has vanished. These entries are evidence about specific state, not interchangeable proofs of identity or access.

Check it quickly

Save this as procview.py and run python3 procview.py in a disposable Linux environment. The 2026-10-15 review recorded this fixture passing on Linux 6.18.44 and Python 3.12.14; it was not rerun here. The script creates one controlled child with a small, explicitly supplied environment, reads only its own and that child’s proc entries, and performs no writes to kernel tuning interfaces:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,subprocess,sys

worker=r'''
from pathlib import Path
import ctypes,json,os,sys
assert ctypes.CDLL(None).prctl(15,b'worker ) sample',0,0,0)==0
os.environ['XB_PROC_TEST']='changed-after-start'
path=Path(sys.argv[1]);path.write_bytes(b'fixture-data')
with path.open('rb') as handle:
 info=os.fstat(handle.fileno());path.unlink()
 print(json.dumps({'fd':handle.fileno(),'device':info.st_dev,'inode':info.st_ino,'current_environment':os.environ['XB_PROC_TEST']}),flush=True)
 assert sys.stdin.readline()=='done\n'
'''
with TemporaryDirectory(prefix='xbcatm-proc-') as directory:
 path=Path(directory)/'data'
 process=subprocess.Popen([sys.executable,'-c',worker,str(path),'argument with spaces'],stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True,env={'PATH':'/usr/bin:/bin','XB_PROC_TEST':'fixture-value'})
 try:
 metadata=json.loads(process.stdout.readline());root=Path('/proc')/str(process.pid)
 status_path=root/'status';status_text=status_path.read_text()
 assert status_path.stat().st_size==0 and len(status_text)>0
 status=dict(line.split(':',1) for line in status_text.splitlines() if ':' in line)
 assert int(status['Pid'])==process.pid and int(status['PPid'])==os.getpid()
 raw=(root/'stat').read_text();pid_text,rest=raw.split(' (',1);comm,fields=rest.rsplit(') ',1)
 fields=fields.split();assert int(pid_text)==process.pid and comm=='worker ) sample'
 assert int(fields[1])==os.getpid() and int(fields[19])>0
 assert raw.split()[2] not in ('R','S','D','T','Z')
 print('proc files can have size zero but readable data; stat comm can contain spaces and a closing parenthesis')
 args=(root/'cmdline').read_bytes().rstrip(b'\0').split(b'\0')
 environment=(root/'environ').read_bytes().rstrip(b'\0').split(b'\0')
 assert args[-1]==b'argument with spaces' and b'XB_PROC_TEST=fixture-value' in environment
 assert metadata['current_environment']=='changed-after-start'
 assert os.readlink('/proc/self')==str(os.getpid())
 print('cmdline and environ use NUL separators; environ retains the initial value here; self resolves for the reader')
 entry=root/'fd'/str(metadata['fd']);target=os.readlink(entry);actual=entry.stat()
 assert target==str(path)+' (deleted)' and not path.exists()
 assert (actual.st_dev,actual.st_ino)==(metadata['device'],metadata['inode'])
 assert entry.read_bytes()==b'fixture-data'
 print('a deleted pathname remains inspectable through an open descriptor subject to access checks')
 output,error=process.communicate('done\n',timeout=5)
 assert process.returncode==0,error
 assert not root.exists()
 print('after the controlled child exits and is reaped, its proc directory disappears')
 finally:
 if process.poll() is None:process.kill();process.wait()

The child sets its short process name to worker ) sample, opens a temporary file, and unlinks its pathname while keeping the descriptor open. It then reports only fixture metadata and waits. This gives the controller a known live process whose name deliberately exercises the stat-format edge case.

The controller finds that status has reported size zero but nonempty readable contents. It checks labeled PID and parent PID fields. For stat, it separates the PID and parenthesized name before interpreting the remaining positional fields, confirming the parent PID and a positive start-time field. Naive whitespace splitting would mistake part of the name for a later field.

The final command-line argument contains spaces and remains one argument after NUL-based parsing. The initial environment contains XB_PROC_TEST=fixture-value, even though the child has changed its application environment value after startup. Both observations use harmless fixture data. They demonstrate why whitespace parsing and assuming a live environment map can produce incorrect conclusions.

Reading /proc/self in the controller resolves to the controller’s PID. Reading the child’s descriptor link returns the removed pathname with the deleted suffix, but following that proc descriptor entry still exposes the expected device/inode pair and fixture bytes under the experiment’s permissions. The missing ordinary pathname and the surviving open object are distinct facts.

After receiving the controller’s message, the child closes its handle and exits. The controller waits for completion and confirms that this child’s proc directory disappears. The example establishes a controlled before-and-after lifecycle observation; it does not promise atomic consistency among arbitrary proc reads while a busy application changes its state.

Match the view to the question

Use the relevant entry’s documented parser and units. A stat field number should be interpreted only after handling the command-name field correctly; a status label should not be assigned an assumed line number. If correlating samples, include process start time and boot context as appropriate so a reused numeric PID is not silently treated as the same instance.

Access and namespace context matter. Proc mount options, credentials, and ptrace-related checks can restrict visibility. /proc/net reflects the relevant network namespace, and a container’s visible proc data is not automatically its configured resource budget. Confirm which namespace and resource interface answer the operational question before labeling an observation as host-wide or container-specific.

Some proc entries are writable controls, but their scope differs. /proc/sys exposes tunables, while /proc/PID/oom_score_adj adjusts a particular process’s OOM preference; writing integers to status is not the interface for that task. Keep observation separate from a deliberate configuration change, and inspect the actual target and documented permissions before applying any write.

Sources

proc(5), procfs structure, per-process visibility, and mount options, checked 2026-10-15.
proc_pid_stat(5), field layout, parenthesized command name, and start time, checked 2026-10-15.
proc_pid_environ(5), initial environment region and NUL-separated entries, checked 2026-10-15.
proc_pid_fd(5), descriptor links, referenced objects, and permission checks, checked 2026-10-15.
proc_pid_cmdline(5), argument separators and process-controlled command-line contents, checked 2026-10-15.

Proc · XB Field Notes

Read procfs as documented views of a changing process

When it breaks

Check it quickly

Match the view to the question

Sources