I didn't have any luck using lsof
to list processes with read-write access to files (maybe I just overlooked the option in my version of lsof
), but I ended up finding this Digital Ocean guide which showed how to get that info using fuser
.
Here is some test output from an Ubuntu 16.04 box:
$ sudo fuser -v /etc/os-release
USER PID ACCESS COMMAND
/usr/lib/os-release: root 827 f.... snapd
$ sudo fuser -v /proc/kmsg
USER PID ACCESS COMMAND
/proc/kmsg: syslog 989 f.... rsyslogd
As noted in the guide:
The above output shows that, when ran in verbose mode, the fuse
utility gives information about the USER, PID, ACCESS and COMMAND. There are many access types such as e(executable being
run), r(root directory), f(open file. f is omitted in default display
mode), F(open file for writing, F is omitted in default display mode)
and m (mmap’ed file or shared library).
In each of those above examples the files are open for reading. Here is an example of a file that is open for writing:
$ sudo fuser -v /run/systemd/journal/syslog
USER PID ACCESS COMMAND
/run/systemd/journal/syslog:
root 1 F.... systemd
syslog 989 F.... rsyslogd
Here you can see that both systemd
and rsyslogd
have write access to the /run/systemd/journal/syslog
"file" (socket in this case).