What do the / proc / fd file descriptors show?

Examining a directory /proc/

today, in particular, I'm interested in the security implications of having all the information about a process semi-publicly available, so I wrote a simple program that does some simple things that allow me to examine some of the properties of a directory /proc/

:

#include <iostream>
#include <unistd.h>
#include <fcntl.h>

using namespace std;

extern char** environ;

void is_linux() {
#ifdef __linux
   cout << "this is running on linux" << endl;    
#endif
}

int main(int argc, char* argv[]) {
  is_linux();

  cout << "hello world" << endl;
  int fd = open("afile.txt", O_RDONLY | O_CREAT, 0600);
  cout << "afile.txt open on: " << fd << endl;

  cout << "current pid: " << getpid() << endl;;

  cout << "launch arguments: " << endl;
  for (int index = 0; index != argc; ++index) {
    cout << argv[index] << endl;
  }

  cout << "program environment: " << endl;
  for (char** entry = environ; *entry; ++entry) {
    cout << *entry << endl;
  }

  pause();
}

      

I wonder though (I don't care) when I check the file descriptors folder ( /pid/<PID#>/fd

) I see this:

root@excalibur-VirtualBox:/proc/1546/fd# ls -l
total 0
lrwx------ 1 root root 64 Nov  7 09:12 0 -> /dev/null
lrwx------ 1 root root 64 Nov  7 09:12 1 -> /dev/null
lrwx------ 1 root root 64 Nov  7 09:12 2 -> /dev/null
lrwx------ 1 root root 64 Nov  7 09:12 3 -> socket:[11050]

      

why do file descriptors point to /dev/null

? Does this mean that the user cannot insert content into the file without the actual process itself, or am I disagreeing with that? And even more curious, why does the file descriptor in an open file point to a socket? It seems strange. If anyone can shed some light on this for me, I'd really appreciate it. Thank!

+3


source to share


1 answer


You are definitely looking at the wrong directory /proc

(for a different PID or on a different computer). The content /proc/<pid>/fd

for your program should look like this:

lrwx------ 1 user group 64 Nov  7 22:15 0 -> /dev/pts/4
lrwx------ 1 user group 64 Nov  7 22:15 1 -> /dev/pts/4
lrwx------ 1 user group 64 Nov  7 22:15 2 -> /dev/pts/4
lr-x------ 1 user group 64 Nov  7 22:15 3 -> /tmp/afile.txt

      



Here we can see that file descriptors 0, 1 and 2 are shown as symbolic links to the pseudo-terminal in which the program is running. This might be /dev/null

if you started your program with input, output and error redirection. File descriptor # 3 points to the file afile.txt

that is currently open.

+2


source







All Articles