/proc: the kernel as a filesystem

Files that are not on any disk

/proc is a virtual filesystem: nothing in it is stored anywhere. When you read one of its files, the kernel generates the text on the spot from its own data structures. That is why ls -l /proc/meminfo shows a size of 0, yet cat prints a page of numbers, and why reading the same file twice can give different answers. /proc/mounts lists it as filesystem type proc. It is the kernel's window for user programs, and every tool in this module looks through it: BusyBox ps walks the numbered directories, top and uptime read /proc/loadavg, and pidof compares names found in /proc/*/stat.

One directory per process

~% sleep 800 > /dev/null &
[1] 897
~% head -7 /proc/897/status
Name:	sleep
Umask:	0022
State:	S (sleeping)
Tgid:	897
Ngid:	0
Pid:	897
PPid:	859
~% tr '\0' ' ' < /proc/897/cmdline; echo
sleep 800
~% readlink /proc/897/cwd
/root
~% readlink /proc/897/exe
/bin/busybox
~% ls -l /proc/897/fd
lr-x------  1 root root 64 Oct  7 19:47 0 -> /dev/null
l-wx------  1 root root 64 Oct  7 19:47 1 -> /dev/null
l-wx------  1 root root 64 Oct  7 19:47 2 -> /dev/null

/proc/self is a symlink that always points at the process reading it, and your shell's own directory is /proc/$. These files answer questions no other tool here can: *which directory was that job started in?* (cwd), *which file is it writing to?* (fd), *what environment did it get?* (environ). They also enforce permissions: a normal user cannot read another user's environ or fd. Directories vanish the instant the process exits.

The system files

Outside the numbered directories live the system-wide views: /proc/cpuinfo (here a single *Pentium III*), /proc/meminfo (lesson 62 reads it line by line), /proc/uptime and /proc/loadavg, /proc/version with the kernel build, /proc/mounts, /proc/partitions, and /proc/cmdline, the parameters the bootloader passed to the kernel. Module 7 opens with the friendly commands built on top of them.

/proc/sys: knobs you can turn

~% cat /proc/sys/kernel/pid_max
32768
~% cat /proc/sys/vm/swappiness
60
~% echo 30 > /proc/sys/vm/swappiness
~% sysctl vm.swappiness
vm.swappiness = 30
~% sysctl -w vm.swappiness=60
vm.swappiness = 60

Under /proc/sys most files are writable by root, and writing changes the running kernel immediately: the hostname, the maximum PID, how eagerly memory is swapped, network behaviour. sysctl is the same thing with dots instead of slashes: vm.swappiness is /proc/sys/vm/swappiness; -n prints only the value, -w writes, -a lists everything. Changes last until reboot; distributions reapply permanent ones from /etc/sysctl.conf at boot.

Module review