[{"data":1,"prerenderedAt":244},["ShallowReactive",2],{"content:\u002F2026\u002Flinuxproc":3,"surround:\u002F2026\u002Flinuxproc":233},{"id":4,"title":5,"body":6,"categories":210,"date":212,"description":213,"draft":214,"extension":215,"image":216,"meta":217,"navigation":219,"path":220,"permalink":221,"published":221,"readingTime":222,"recommend":221,"references":221,"seo":227,"sitemap":228,"stem":229,"tags":230,"type":231,"updated":212,"__hash__":232},"content\u002Fposts\u002F2026\u002FLinux的proc文件系统.md","Linux的proc文件系统",{"type":7,"value":8,"toc":190},"minimark",[9,14,23,27,42,45,50,56,66,69,73,80,83,94,97,106,109,131,134,141,147,150,153,156,162,165,175,179],[10,11,13],"h2",{"id":12},"proc-文件系统","\u002Fproc  文件系统",[15,16,17,18,22],"p",{},"Linux 系统上的 ",[19,20,21],"code",{"code":21},"\u002Fproc"," 目录是一种文件系统，即 proc 文件系统，它是一种伪文件系统，由内核动态生成内容，主要是用于获取一些系统和进程信息，开发调试内核。",[10,24,26],{"id":25},"proc-目录","\u002Fproc  目录",[15,28,29,30,33,34,37,38,41],{},"在 \u002Fproc 目录下，有文件系统信息、设备信息、进程信息、内核信息、self 等许多文件夹，其中进程信息通常是",[19,31,32],{"code":32},"\u002Fproc\u002FPID"," 的目录结构，这也是本篇文章重点学习的。除此之外，",[19,35,36],{"code":36},"\u002Fproc\u002Fmounts"," 可以看一些挂载信息，对于我们提权会有一些帮助；",[19,39,40],{"code":40},"\u002Fproc\u002Fnet"," 可以看一些网络相关的，其中 tcp 文件可以去看开放哪些端口，进行信息收集。",[10,43,32],{"id":44},"procpid",[46,47,49],"h3",{"id":48},"pid","PID",[15,51,52,53,55],{},"PID 是 Linux 给每一个运行中的进程分配一个唯一数字，当进程启动后，内核会分给该进程一个数字，然后为其创建",[19,54,32],{"code":32}," 目录，里面保存这个进程的信息。下面有一些相关的操作。",[57,58,64],"pre",{"className":59,"code":61,"language":62,"meta":63},[60],"language-bash","echo $$       \t\t\t\t\t\t\t\t# 查看当前 shell 的 PID\nps aux                              # 查看所有进程\nls \u002Fproc | grep -E '^[0-9]+$'       # 列出所有 PID 目录\n","bash","",[19,65,61],{"__ignoreMap":63},[46,67,68],{"id":68},"目录结构",[70,71,72],"h4",{"id":72},"cmdline",[15,74,75,76,79],{},"cmdline 保存启动该进程时使用的完整命令行参数，用 ",[19,77,78],{"code":78},"cat \u002Fproc\u002F2043\u002Fcmdline | tr '\\0' ' '"," 查看，僵尸进程文件内容为空。",[70,81,82],{"id":82},"cwd",[15,84,85,86,89,90,93],{},"cwd 是指向当前进程运行目录的一个符号链接，用",[19,87,88],{"code":88},"ls -al \u002Fproc\u002F2043\u002Fcwd"," 或者 ",[19,91,92],{"code":92},"readlink \u002Fproc\u002F2043\u002Fcwd"," 查看。",[70,95,96],{"id":96},"exe",[15,98,99,100,89,103,93],{},"exe 是一个指向启动当前进程的可执行文件（完整路径）的符号链接，用",[19,101,102],{"code":102},"ls -al \u002Fproc\u002F2043\u002Fexe",[19,104,105],{"code":105},"readlink \u002Fproc\u002F2043\u002Fexe",[70,107,108],{"id":108},"environ",[15,110,111,112,115,116,119,120,123,124,127,128,130],{},"environ 是当前进程的环境变量列表，以",[19,113,114],{"code":114},"NAME=value","格式存储，惯例上变量名用大写（但不是强制，如 ",[19,117,118],{"code":118},"http_proxy"," 等小写变量也常见），用",[19,121,122],{"code":122},"cat \u002Fproc\u002F2043\u002Fenviron | tr '\\0' '\\n'"," 查看。注意 ",[19,125,126],{"code":126},"\u002Fproc\u002FPID\u002Fenviron"," 和 ",[19,129,72],{"code":72}," 通常只有进程所有者或 root 才能读取，做题时权限不足会读不到。",[70,132,133],{"id":133},"fd",[15,135,136,137,140],{},"fd 是一个目录，包含当前进程打开的每一个文件的文件描述符，每个文件描述符又是指向一个实际文件的符号链接，用",[19,138,139],{"code":139},"ls -al \u002Fproc\u002F2043\u002Ffd"," 查看，默认情况下",[57,142,145],{"className":143,"code":144,"language":62,"meta":63},[60],"fd 0  → 终端输入\nfd 1  → 终端输出\nfd 2  → 错误输出\n",[19,146,144],{"__ignoreMap":63},[15,148,149],{},"（若进程重定向过标准输入输出，fd 0\u002F1\u002F2 会指向重定向后的文件。）",[15,151,152],{},"在一些题目中，可能打开一些文件后没有读取，或者打开后删去，只要进程还没有关闭，我们就可以用这种方式获取。",[70,154,155],{"id":155},"status",[15,157,158,159,93],{},"status 存储进程状态信息，用",[19,160,161],{"code":161},"cat \u002Fproc\u002F2043\u002Fstatus",[70,163,164],{"id":164},"root",[15,166,167,168,171,172,93],{},"root 是当前进程根目录的一个符号链接，在 Unix 和 Linux 系统上，通常采用 chroot 命令使每个进程运行于独立的根目录，该文件可以去看进程根目录，用",[19,169,170],{"code":170},"ls -al \u002Fproc\u002F2043\u002Froot"," 或 ",[19,173,174],{"code":174},"readlink \u002Fproc\u002F2043\u002Froot",[10,176,178],{"id":177},"procself","\u002Fproc\u002Fself",[15,180,181,182,185,186,189],{},"self 这个目录总是指向访问它的进程自身的目录，不同进程打开获得的信息是不同的，有时候进程的 PID 会改变，我们就可以用 self 去查看。但是在做题时我们不能通过",[19,183,184],{"code":184},"cat \u002Fproc\u002Fself\u002Fcmdline"," 去查看，因为这时候得到的是 cat 进程的信息，应该通过题目本身进程去查看，比如用文件包含",[19,187,188],{"code":188},"?filename=\u002Fproc\u002Fself"," 的方式。",{"title":63,"searchDepth":191,"depth":191,"links":192},4,[193,195,196,209],{"id":12,"depth":194,"text":13},2,{"id":25,"depth":194,"text":26},{"id":44,"depth":194,"text":32,"children":197},[198,200],{"id":48,"depth":199,"text":49},3,{"id":68,"depth":199,"text":68,"children":201},[202,203,204,205,206,207,208],{"id":72,"depth":191,"text":72},{"id":82,"depth":191,"text":82},{"id":96,"depth":191,"text":96},{"id":108,"depth":191,"text":108},{"id":133,"depth":191,"text":133},{"id":155,"depth":191,"text":155},{"id":164,"depth":191,"text":164},{"id":177,"depth":194,"text":178},[211],"技术","2026-07-30 11:11:31","最近做题碰到好多\u002Fproc这个目录，找点文章学习一下",false,"md","\u002F2026\u002FLinux的proc文件系统\u002Fcover.jpg",{"slots":218},{},true,"\u002F2026\u002Flinuxproc",null,{"text":223,"minutes":224,"time":225,"words":226},"4 min read",3.88,232800,776,{"title":5,"description":213},{"loc":220},"posts\u002F2026\u002FLinux的proc文件系统",[],"tech","ID2akEAyPK57XIW5iFQBpl4NN8oc50QSmTVNm_DjKsw",[234,239],{"title":235,"path":236,"stem":237,"date":238,"type":231,"children":-1},"Python PIN 码","\u002F2026\u002Fpython-pin","posts\u002F2026\u002FPython PIN 码","2026-07-22 23:03:04",{"title":240,"path":241,"stem":242,"date":243,"type":231,"children":-1},"Linux 提权","\u002F2026\u002Flinux","posts\u002F2026\u002FLinux 提权","2026-08-05 17:36:30",1786110316741]