The /proc File System

• In the old days, certain UNIX programs, such as ps and uptime, accessed kernel data structures directly to retrieve system information.
  • This required knowledge of kernel externals and required care to ensure that the values were not modified as they were being accessed.
  • The programs needed to be setuid root in order to access the kernel data structures; this meant they were vulnerable to security exploits if they were not carefully written.
  • These programs also frequently had to be rebuilt when the kernel was changed because the positions and layouts of the data structures may have changed.
• Modern systems implement a /proc filesystem that contains special files that can be read to access system status information.
• /proc is a window into the running Linux kernel. Files in the /proc file system don't correspond to actual files on a physical device.
  • Instead, they are magic objects that behave like files but provide access to parameters, data structures, and statistics in the kernel.
• The contents of these files are not always fixed blocks of data, as ordinary file contents are.
  • Instead, they are generated on the fly by the Linux kernel when you read from the file.
• You can also change the configuration of the running kernel by writing to certain files in the /proc file system.
• The code that implements the /proc filesystem and some of its entries can be found in /usr/src/linux/fs/proc. Portions of the proc namespace are registered using the kernel function proc_register().

  $ ls -l /proc/version
  $ cat /proc/version
  $ man 5 proc