I need to identify the cgroup of a process given the socket. Specifically, I have a process on the same machine that is calling my process using tcp, and I need to identify the process or its cgroup. The tcp requirement is because I'm simulating a third party API. I need to return different data depending on which process is calling me. One solution is to determine the socket using /proc/net/tcp, from which I can get the inode for the socket, and then to iterate over /proc/*/fd to find that inode listed. Is there a direct way to map from a (I assume a sockfs) inode to its PID without this iteration?
In general, to find what's at the other end of a socket, you need to iterate through
/proc. This can of course mean letting an existing tool such as
ss do it for you.
The reason for this is that a socket can be opened by different processes. Once a process has opened a socket, it can fork, and the children can change their privileges and switch to different namespaces. It's also possible to pass file descriptors from a process to an unrelated process, using anciliary data on a unix socket. So arbitrary processes can have the same socket open. There is no such thing as “the PID of a socket”, only “the PIDs of a socket”.
While this doesn't prove that there's no way to enumerate the PIDs given the socket, it would be very difficult to design such an interface, especially when you consider that non-root users don't get to know when files are opened by processes running as a different user. Access through
/proc enforces security via permissions, and I'm not aware of any other interface to get the same data. Also,
ss all enumerate
/proc; if there was another interface, I'd expect someone to use it. So I'm pretty sure that there's no other way.
if you know the tcp port number then you can use this command in your terminal:
$ lsof | grep TCP | grep your_port_number
Eg: lsof | grep TCP | grep 1234
To determine the cgroup, you can refer to
sk_cgrp_data field in
struct sock. This is an example from
struct cgroup *cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data)