1

While looking for a detection method for services that would need to be rstarted after patching OpenSSL, I stumbled over a difference between the return of those 2 commands :

[root@host ~]# cat /proc/1/maps 
7f751546c000-7f7515478000 r-xp 00000000 fd:01 5170                       /lib64/libnss_files-2.12.so (deleted)
7f751567a000-7f7515804000 r-xp 00000000 fd:01 360                        /lib64/libc-2.12.so (deleted)
7f7515a09000-7f7515a0e000 rw-p 00000000 00:00 0 
7f7515a0e000-7f7515a24000 r-xp 00000000 fd:01 14847                      /lib64/libgcc_s-4.4.7-20120601.so.1
7f7515c24000-7f7515c2b000 r-xp 00000000 fd:01 5173                       /lib64/librt-2.12.so (deleted)
...
[root@host~]# lsof -p 1
COMMAND PID USER   FD   TYPE             DEVICE SIZE/OFF  NODE NAME
init      1 root  cwd    DIR              253,1     4096     2 /
init      1 root  rtd    DIR              253,1     4096     2 /
init      1 root  txt    REG              253,1   150352   534 /sbin/init
init      1 root  DEL    REG              253,1           5170 /lib64/libnss_files-2.12.so
init      1 root  DEL    REG              253,1            360 /lib64/libc-2.12.so
init      1 root  mem    REG              253,1    90880 14847 /lib64/libgcc_s-4.4.7-20120601.so.1
init      1 root  DEL    REG              253,1           5173 /lib64/librt-2.12.so
...

Why does the first one say they've been deleted, while the other doesn't ?

I'd also like to add that the last system reboot is more recent than the last modification of those files, which tends to make me think that they haven't been deleted since last boot...

closed as unclear what you're asking by Gilles, Michael Homer, G-Man, cuonglm, X Tian Jul 10 '15 at 4:05

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I'd think that lsof just looks for an existing file with the same path, while the maps file is bound to the inode or something that detects changes between the in-memory and the filesystem versions. Would like a more enlighted/precise answer though – mveroone Jul 9 '15 at 9:41
  • 2
    lsof shows FD: DEL, which man lsof says is "for a Linux map file that has been deleted;" – Ulrich Schwarz Jul 9 '15 at 11:45
  • The two commands show the same three files as deleted. What part of the output are you surprised by? – Gilles Jul 9 '15 at 22:26
  • Myfault, i missed the DEL flag, and the manpage part detailing it. Should I delete the question ? – mveroone Jul 10 '15 at 15:22
2

lsof lists open files, and mmap(2) can access data after the file descriptor is closed or even unlink-ed (it is using an i-node), but /proc/$PID/maps try to show something about them.

Not the answer you're looking for? Browse other questions tagged or ask your own question.