I didn’t know any of this. Amazing. I usually just look at
/proc/net/for routes and bonding config etc.I know what a symlink is, but what is a magic symlink?
If you delete a file that’s still open by the app, the link in proc will still exist and you can copy the file back out of proc.
Does that not make them a hard link (pointing to a filesystem node) instead of a symlink (pointing to another filename)?
No, you can’t have a hard link cross filesystems and proc is its own fs type.
Ah - it has its own special magical file system type, that’s the secret sauce. Neat!
/dev and /sys are the other two special ones
Remember the old days before /dev was its own virtual filesystem?
It still is! If you try and boot a kernel with nothing in /dev, you won’t get most of the kernel boot messages since /dev/console doesn’t exist. You need a basic set of device nodes in /dev before udev is started.
If you’re going to rsync a system to new hardware and exclude /dev /proc /sys, it’s better to setup a new mount of your / to a different directory and sync off that, so you get the underlying stuff without the cruft.
These days there can be a dozen virtual filesystems doing various stuff. If you ever want to get quite baffled, install a terminal emulator on an Android phone (not Termux) and run
mount.
A symlink that has been blessed by Richard Stallman.
“Now that’s a name I haven’t heard in a long time” -Saint IGNUcius
Also known as zombie files. If you are unlucky they can take up all space on a drive, or even tmpfs (so your ram) and you can’t easily find them. At least until you end the right process or restart.
Had that happen once and had to write my own script to trace it to the log of an open terminal emulator tab that had billions of lines.
Do you know how to build portable executables?
configure --prefix=/proc/self/pwdIt even works in .so files and libtool.
How would this differ from
--prefix=$(pwd)?--prefix=$(pwd)is resolved at compile time. If you move your compiled .so files to a different directory, they stop working.I see what you mean, very clever solution if a program is using the configure prefix by compiling it into the binary.
That can’t be very common though is it? Usually the configure prefix is just used by
make installto install the binaries into the prefix. If the compiled program needs to know where it is installed it can readargv[0].Have you seen this used somewhere?
I am using this myself in Android app, where you can write files only inside
/data/data/your.app.id/So naturally, if you want to publish a different app,
your.app.idwill be different, so you need to recompile all your Linux tools that you bundle inside your app.If you are not running your Linux tools on Android, you’d probably be better off using Docker or a chroot.
May I have the explanation?
The executable will search for .so files not inside predefined paths like /usr/lib but inside it’s current directory. You may theoretically put
.as an argument toconfigure, but it converts that into an absolute path, snd libtool and linker fail when encountering relative paths inside shared library dependencies.
I would generally just set the RPATH to
$ORIGINin the ELF file
Julia Evans has such great and accessible content, they’re awesome
they are a youtuber?
Better, they make zines! https://jvns.ca/
thanks, it’s got really hard nowdays to find quality content.
Maybe a dumb question, but is… a zine just a blog entry?
Zine is short for magazine, I think. Offline zines are often self-published paper booklets, produced by lone wolves or communities, with a focus on one subject. Digital zines are often PDFs. Sometimes a printable booklet version is provided so they can be printed and distributed. Here’s an example of a digital zine: https://digitalselfdefence.net/pdf/dsdc-zine.pdf
We need the whole set of these in one post
THERE’S MORE?
Wait, is there not?
You used to be able to sudo cat /proc/kcore > /dev/dsp and listen to your ram
Wouldn’t that just sound like gibberish? I feel like Mike Lindell would come out of the speakers.
it rotated in between white noise, strobing sirens, digital corruption and silence.
The RAM whisperer.
That sounds really interesting! I couldn’t find anything else on this. Is this like pre-systemd?
It was before OSS was taken over by ALSA (and other things) for sound. OSS let you play loose and fast and was very forgiving. I just tried using pulseaudio to do it and barely got a burble of static out of it.
That is super rad. I wonder how hard it would be to replicate today.
We could have a “RAMcore” subgenre. I wonder how running different processes affects the sound?
Imagine if the German underground scene discovered RAM noises. . .damn, RAMmstein is already taken. XD
All seriousness though…I now wanna know what my RAM sounds like. Lol
Stand up an old VM that still has OSS. I screwed around with current drivers and didn’t get anything cool sounding.
Julia Evans has a bunch of these really handy cheatsheets. I have several saved that I reference semi-regularly.
Got to love UNIX’s everything is a file.
ProcFS is from Plan9. https://en.wikipedia.org/wiki/Plan_9_from_Bell_Labs#/proc
Plan9 is worth a deep dive, but maybe not worth running. It is more UNIX than UNIX. (Also where UTF8 came from.)
I did not know that about plan9!
/procwas one of the things I missed most when I switched from daily driving linux to daily driving osx.Well that is retrograde of it.
Another cool thing from Plan9:
https://github.com/torvalds/linux/blob/master/Documentation/filesystems/9p.rst
Did you know openBSD does not have this folder? I think the BSD’s do not use /proc. I do not know why though.
That raises the question of how their
ps,top,lsofand such work, since afaik in Linux they read from /proc.P.S. Looks like BSDs tug at the kernel via syscalls, namely
sysctland also the ‘kvm interface’ in the case of MacOS (not sure what ‘kvm’ thing is meant here). Seems vaguely reasonable, since procfs also queries the kernel for the info, so about the same resources would be used, perhaps even with the overhead of filesystem traversal and string-numbers conversion.I might be mistaken, but I think kvm stands for kernel virtual machine. Having no /proc, and interacting with sysctl instead sounds more secure, IMO.
/proc is quite useful when it comes to hiding root on Android.
Great tips! Although if i may 🤓 just a little for the top right, it works because what you deleted isn’t the binary, it’s the pointer that points to the binary’s location. The data is still exactly as it was before “deletion”; the symlink is simply a copy of the original pointer’s info; and I’m speculating that the existence of any pointer prevents the system from recycling those addressed bits.
it merely deletes the inode from the directory instead of overwriting the actual data on the disk
I am saving this, both for the post AND for the comments.
Thank you for sharing this. Got a new creator to check out now!
I’m aware of /proc but usually use lsof to find open fd’s for a process.
Is one better than the other?
lsofjust reads from/procand gives you formatted outputhttps://github.com/lsof-org/lsof/blob/master/lib/dialects/linux/dproc.c#L297
I seem to recall in an Operating Systems class we wrote a kernel module and communicated with it through the proc interface?
I may have been through “SysFS” as well? In
/sys/classyou can setup char dev IO with a kernel module (and more). Very helpful for userspace <-> kernel communication (like DMA drivers for userspace applications)Hmm yeah maybe it was /sys, it’s been so long I can’t remember.
I seem to recall echoing into a file to set some value which we then checked the value of in the kernel module code. It was just a hello world type of thing for a college class.
