Special File Systems

1
2
3
4
5
6
7
8
9

# /proc is typically mounted by the init system before normal boot
proc    /proc    proc    defaults    0    0
 
# Manual mount command (for reference)
mount -t proc proc /proc
 
# View mount status
$ mount | grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# View memory maps for the current shell
$ cat /proc/self/maps
 
# Output format: address perms offset dev inode pathname
5622e7c00000-5622e7c28000 r--p 00000000 08:02 1311623  /usr/bin/bash
5622e7c28000-5622e7cd7000 r-xp 00028000 08:02 1311623  /usr/bin/bash
5622e7cd7000-5622e7d0e000 r--p 000d7000 08:02 1311623  /usr/bin/bash
5622e7d0f000-5622e7d13000 r--p 0010e000 08:02 1311623  /usr/bin/bash
5622e7d13000-5622e7d1c000 rw-p 00112000 08:02 1311623  /usr/bin/bash
5622e7d1c000-5622e7d27000 rw-p 00000000 00:00 0        [heap]
...
7f8a12800000-7f8a12822000 r--p 00000000 08:02 1315871  /usr/lib/libc.so.6
7f8a12822000-7f8a1299a000 r-xp 00022000 08:02 1315871  /usr/lib/libc.so.6
...
7ffdab4f3000-7ffdab514000 rw-p 00000000 00:00 0        [stack]
7ffdab5a4000-7ffdab5a8000 r--p 00000000 00:00 0        [vvar]
7ffdab5a8000-7ffdab5aa000 r-xp 00000000 00:00 0        [vdso]
 
# Breakdown:
# - Address range (start-end)
# - Permissions: r=read, w=write, x=execute, p=private/s=shared
# - Offset within the mapped file
# - Device (major:minor)
# - Inode number
# - Path (or special region name)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

# Reading kernel parameters
 
# Check maximum number of open files system-wide
$ cat /proc/sys/fs/file-max
1048576
 
# Check VM swappiness (how aggressively kernel swaps)
$ cat /proc/sys/vm/swappiness
60
 
# Check IP forwarding status (routing)
$ cat /proc/sys/net/ipv4/ip_forward
0
 
# Modifying kernel parameters (requires root)
 
# Enable IP forwarding (make this machine a router)
$ echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
1
 
# Reduce swappiness (prefer keeping pages in RAM)
$ echo 10 | sudo tee /proc/sys/vm/swappiness
10
 
# Using sysctl command (same effect, nicer syntax)
$ sudo sysctl vm.swappiness=10
vm.swappiness = 10
 
# View all parameters
$ sysctl -a | head -20
abi.vsyscall32 = 1
debug.exception-trace = 1
debug.kprobes-optimization = 1
dev.cdrom.autoclose = 1
dev.cdrom.autoeject = 0
dev.cdrom.check_media = 0
...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

/* Simplified example: How /proc/uptime is implemented */
 
#include <linux/fs.h>
#include <linux/seq_file.h>
#include <linux/proc_fs.h>
 
/* Called when file is read - generates the content */
static int uptime_proc_show(struct seq_file *m, void *v)
{
    struct timespec64 uptime;
    struct timespec64 idle;
    
    /* Get uptime from kernel timekeeping */
    ktime_get_boottime_ts64(&uptime);
    
    /* Get aggregate idle time across all CPUs */
    get_idle_time(&idle);
    
    /* Format and output: "uptime_seconds.centisecs idle_seconds.centisecs" */
    seq_printf(m, "%lu.%02lu %lu.%02lu
",
               (unsigned long) uptime.tv_sec,
               (uptime.tv_nsec / (NSEC_PER_SEC / 100)),
               (unsigned long) idle.tv_sec,
               (idle.tv_nsec / (NSEC_PER_SEC / 100)));
    
    return 0;  /* Success */
}
 
/* Called when file is opened - uses single_open for simple files */
static int uptime_proc_open(struct inode *inode, struct file *file)
{
    return single_open(file, uptime_proc_show, NULL);
}
 
/* File operations structure - registered with procfs */
static const struct proc_ops uptime_proc_ops = {
    .proc_open    = uptime_proc_open,
    .proc_read    = seq_read,
    .proc_lseek   = seq_lseek,
    .proc_release = single_release,
};
 
/* Module initialization - creates /proc/uptime */
static int __init proc_uptime_init(void)
{
    proc_create("uptime", 0444, NULL, &uptime_proc_ops);
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

# Mounting /proc with hidepid for user isolation
 
# hidepid=0: Default, all users see all processes
# hidepid=1: Users can see /proc/[pid] but not cmdline, environ, etc.
# hidepid=2: Users only see their own processes
 
# Remount with hidepid=2 for maximum isolation
$ sudo mount -o remount,hidepid=2 /proc
 
# Add to /etc/fstab for persistence
proc    /proc    proc    defaults,hidepid=2    0    0
 
# Check the effect - regular user now only sees own processes
$ ls /proc | grep -E '^[0-9]'
1234
1235
# (only own PIDs visible)
 
# Container environments often use hidepid for security

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

# ═══════════════════════════════════════════════════════════════
# SCENARIO 1: Find all processes with a specific file open
# ═══════════════════════════════════════════════════════════════
 
# Find which process has /var/log/syslog open
$ for pid in /proc/[0-9]*; do
    if ls -la $pid/fd 2>/dev/null | grep -q syslog; then
        echo "PID $(basename $pid): $(cat $pid/comm)"
    fi
done
PID 1234: rsyslogd
 
# ═══════════════════════════════════════════════════════════════
# SCENARIO 2: Analyze process memory usage in detail
# ═══════════════════════════════════════════════════════════════
 
# Get detailed private/shared memory breakdown
$ cat /proc/$(pgrep firefox)/smaps_rollup
Rss:             1234567 kB
Pss:              987654 kB   # Proportional share (accounts for shared)
Shared_Clean:     123456 kB
Shared_Dirty:      12345 kB
Private_Clean:    234567 kB
Private_Dirty:    567890 kB
 
# ═══════════════════════════════════════════════════════════════
# SCENARIO 3: Diagnose a process waiting on I/O
# ═══════════════════════════════════════════════════════════════
 
# Check what system call a blocked process is waiting on
$ cat /proc/12345/stack
[<0>] io_schedule+0x12/0x40
[<0>] wait_on_page_bit+0x76/0x80
[<0>] __lock_page+0x2a/0x30
[<0>] filemap_fault+0x123/0x456
...
 
# See which file descriptor is blocked
$ cat /proc/12345/wchan
wait_on_page_bit
 
# ═══════════════════════════════════════════════════════════════
# SCENARIO 4: Calculate actual system memory usage
# ═══════════════════════════════════════════════════════════════
 
# Script to compute real free memory
calculate_memory() {
    awk '/^MemTotal:/ { total=$2 }
         /^MemAvailable:/ { avail=$2 }
         /^Buffers:/ { buffers=$2 }
         /^Cached:/ { cached=$2 }
         /^SwapTotal:/ { swaptotal=$2 }
         /^SwapFree:/ { swapfree=$2 }
         END {
             used = total - avail
             swapused = swaptotal - swapfree
             printf "Total: %d MB
", total/1024
             printf "Used: %d MB (%.1f%%)
", used/1024, used*100/total
             printf "Available: %d MB
", avail/1024
             printf "Swap Used: %d MB
", swapused/1024
         }' /proc/meminfo
}
 
$ calculate_memory
Total: 32000 MB
Used: 8234 MB (25.7%)
Available: 23766 MB
Swap Used: 0 MB