LINK="#3366FF" VLINK="#A000A0">



(?) The Answer Gang (!)


By Jim Dennis, Ben Okopnik, Dan Wilder, Breen, Chris, and the Gang, the Editors of Linux Gazette... and You!
Send questions (or interesting answers) to tag@lists.linuxgazette.net

There is no guarantee that your questions here will ever be answered. You can be published anonymously - just let us know!


(?) I was wondering

From andrew

Answered By Mike Orr

i see a number of suspicious files in my proc directory.For example there is a directory that is called 6 & when i look in this folder i see i number of files eg

[root@echelon 6]# ls -la
ls: exe: Permission denied
ls: root: Permission denied
ls: cwd: Permission denied
total 0
dr-xr-xr-x    3 root     root            0 Mar 26 14:28 .
dr-xr-xr-x   89 root     root            0 Mar 26 07:32 ..
-r--r--r--    1 root     root            0 Mar 26 14:29 cmdline
lrwx------    1 root     root            0 Mar 26 14:29 cwd
-r--------    1 root     root            0 Mar 26 14:29 environ
lrwx------    1 root     root            0 Mar 26 14:29 exe
dr-x------    2 root     root            0 Mar 26 14:29 fd
pr--r--r--    1 root     root            0 Mar 26 14:29 maps
-rw-------    1 root     root            0 Mar 26 14:29 mem
lrwx------    1 root     root            0 Mar 26 14:29 root
-r--r--r--    1 root     root            0 Mar 26 14:29 stat
-r--r--r--    1 root     root            0 Mar 26 14:29 statm
-r--r--r--    1 root     root            0 Mar 26 14:29 status
(!) [Mike] This is normal. See "man proc".

(?) Notice the permission denied on those 3 files. Why is this if i am root??.

(!) [Mike] I get this error when I'm not root but not if I am root. The three "files" are symbolic links to other directories. So it would depend what the permissions of those "other" directories are.

(?) I cant delete them or change anything about them. What would you suggest?? I mean they are links to other files so why can i just unlink them.

(!) [Mike] You shouldn't try to change or unlink them. The directory will disappear when process 6 dies.
To see for yourself that nothing funny is going on, run "umount /proc" as root. (If you get a "Device Busy" error, it probably means some process has its current directory inside /proc. You cannot unmount a filesystem if somebody's current directory is inside it.) The /proc directory should be empty now. Run "mount /proc" or "mount -t proc proc /proc" and the "files" should reappear.

(?) Also as a side note do you have any idea that when im in shell within this directory that those 3 files are flashing??

(!) [Mike] That's part of the color configuration of the 'ls' command. Usually, flashing means it's a dead symbolic link (a link pointing to a nonexistent file). If it's inside /proc, I would assume the kernel knows what it's doing and not worry about it.


This page edited and maintained by the Editors of Linux Gazette Copyright © 2001
Published in issue 65 of Linux Gazette April 2001
HTML script maintained by Heather Stern of Starshine Technical Services, http://www.starshine.org/


[ Table Of Contents ][ Answer Guy Current Index ] greetings   1   2   3   4   5   6   7   8   9   10   11   12   13   14   15   16   17   18   19   20   21   22   23   24   25   26   27   28   29 [ Index of Past Answers ]