Procfs, process environments, and inherited descriptors

Mechanism

Procfs exposes views of process state such as mappings, command lines, descriptors, and environment, subject to access controls. Inherited file descriptors can retain access to resources after path permissions or identity change. An open descriptor is a capability with its own access mode and lifecycle.

Practical method

Identify the relevant process and inspect only permitted proc entries. Correlate descriptors with their targets and access modes. Look for deleted-but-open files or resources inherited into a lower-privilege process. Distinguish current arguments from original environment and application-managed state.

ls -l /proc/self/fd
cat /proc/self/status
cat /proc/self/maps

Interpreting evidence

A descriptor symlink reveals a target but does not guarantee you can read it. Verify the available operation and preserve the process identity and descriptor number in the evidence.

Pitfalls and limits

Proc access depends on ptrace checks and mount settings. Descriptor numbers are reused. Environments can contain secrets; avoid dumping all values into logs or screenshots.