The Answer Gang

I was wondering

From andrew

Answered By Mike Orr

i see a number of suspicious files in my proc directory.For example there is a directory that is called 6 & when i look in this folder i see i number of files eg

[root@echelon 6]# ls -la
ls: exe: Permission denied
ls: root: Permission denied
ls: cwd: Permission denied
total 0
dr-xr-xr-x    3 root     root            0 Mar 26 14:28 .
dr-xr-xr-x   89 root     root            0 Mar 26 07:32 ..
-r--r--r--    1 root     root            0 Mar 26 14:29 cmdline
lrwx------    1 root     root            0 Mar 26 14:29 cwd
-r--------    1 root     root            0 Mar 26 14:29 environ
lrwx------    1 root     root            0 Mar 26 14:29 exe
dr-x------    2 root     root            0 Mar 26 14:29 fd
pr--r--r--    1 root     root            0 Mar 26 14:29 maps
-rw-------    1 root     root            0 Mar 26 14:29 mem
lrwx------    1 root     root            0 Mar 26 14:29 root
-r--r--r--    1 root     root            0 Mar 26 14:29 stat
-r--r--r--    1 root     root            0 Mar 26 14:29 statm
-r--r--r--    1 root     root            0 Mar 26 14:29 status

[Mike] This is normal. See "man proc".

Notice the permission denied on those 3 files. Why is this if i am root??.

[Mike] I get this error when I'm not root but not if I am root. The three "files" are symbolic links to other directories. So it would depend what the permissions of those "other" directories are.

I cant delete them or change anything about them. What would you suggest?? I mean they are links to other files so why can i just unlink them.

[Mike] You shouldn't try to change or unlink them. The directory will disappear when process 6 dies.

To see for yourself that nothing funny is going on, run "umount /proc" as root. (If you get a "Device Busy" error, it probably means some process has its current directory inside /proc. You cannot unmount a filesystem if somebody's current directory is inside it.) The /proc directory should be empty now. Run "mount /proc" or "mount -t proc proc /proc" and the "files" should reappear.

Also as a side note do you have any idea that when im in shell within this directory that those 3 files are flashing??

[Mike] That's part of the color configuration of the 'ls' command. Usually, flashing means it's a dead symbolic link (a link pointing to a nonexistent file). If it's inside /proc, I would assume the kernel knows what it's doing and not worry about it.

This page edited and maintained by the Editors of Linux Gazette Copyright © 2001
Published in issue 65 of Linux Gazette April 2001

HTML script maintained by Heather Stern of Starshine Technical Services, https://www.starshine.org/

1   2   3   4   5   6   7   8   9   10   11   12   13   14   15   16   17   18   19   20   21   22   23   24   25   26   27   28   29