6

I'm trying to read two specific files, namely status and smaps_rollup for all the processes under /proc. All process directories have dr-xr-xr-x permission and I'm able to enter every one of these directories.

For all the processes the permissions for both of these files are -r--r--r--.

Here's the bizarre behavior. Let's say I try to read both the files for PID 1. I can read status file, but not smaps_rollup. See below:

$ cd /proc/1

$ ls -l status smaps_rollup
-r--r--r-- 1 root root 0 Apr  5 18:34 smaps_rollup
-r--r--r-- 1 root root 0 Mar 21 12:18 status

$ grep "Swap:" status
VmSwap:     1072 kB

$ grep "Swap:" smaps_rollup
grep: smaps_rollup: Permission denied

$ cat smaps_rollup
cat: smaps_rollup: Permission denied

I looked for related questions and came across some of them[1][2][3][4]. None of them has the same problem. The solutions to these other problems had to do with fixing the missing executable permission on the directory. That's not the case here.

Here is mount info for proc:

proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)

I'm running Arch Linux with kernel 6.2.7-arch1-1 provided by Arch Linux.

I'm looking for a correct explanation of this bizarre behavior. And is there something I can do to fix this problem, besides using sudo as a workaround?


  1. Can't read file even though permissions are correct

  2. Why I can't read file?

  3. File read permissions for 'others' not working

  4. How can I check read permission of /proc// files?

2
  • I can receate your results on Debian stable running a 5.10.162 kernel (from the 5.10.0-21 package for Debian stable). Commented Apr 6, 2023 at 14:04
  • A bit of search led me here. Might have to do with ptrace system calls denying read access to smaps_rollup file. But as an end-user how am I supposed to know all this? Journalctl logs gives no clue on this either.
    – Firelord
    Commented Apr 6, 2023 at 14:08

1 Answer 1

10

This doesn’t appear to be explicitly documented; it’s documented transitively in man 5 proc, through the documentation for /proc/[pid]/maps:

Permission to access this file is governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check; see ptrace(2).

The smaps documentation says

The first of these lines shows the same information as is displayed for the mapping in /proc/[pid]/maps.

Since the latter is sensitive, it is protected in a similar fashion. smaps_rollup is less sensitive and could be opened up but the latter patch hasn’t got anywhere as far as I can tell.

It should be possible to use capabilities to work around this, but I haven’t tried.

Many files, directories and links in /proc aren’t necessarily as accessible as indicated by their permissions; in particular, many files require the same privileges as maps and smaps, PTRACE_MODE_READ_FSCREDS. These requirements are detailed in man 5 proc. This means that the visible permissions should only be considered an upper bound on permissions; in particular, they are useful to determine whether a /proc entry is intended for updating kernel settings (it’s writable) rather than only viewing them.

3
  • 8
    Perhaps worth adding that procfs is magic enough that file permissions on it are just a very rough indication of what you might conceivably want to do with a given file. The only thing they tell you is "this file might be writable under some circumstances" or "this file will never be accessible for you, forget it".
    – TooTea
    Commented Apr 6, 2023 at 19:25
  • 2
    Yes, exactly. procfs is its own special driver that can return whatever it wants whenever it wants, regardless of whether "regular files" would do that. read on a procfile could return "too many open files" if the current minute is prime and "no route to host" if it's composite, if the implementation in the kernel wanted it to.
    – hobbs
    Commented Apr 6, 2023 at 22:02
  • 1
    @hobbs technically, that’s true of any file system ;-). Commented Apr 7, 2023 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .