• Linux /proc question (re: Pipes)

    From Scott Lurndal@21:1/5 to Kenny McCormack on Thu Sep 16 16:45:57 2021
    gazelle@shell.xmission.com (Kenny McCormack) writes:
    When I do: ls -lsa /proc/<pid>/fd
    I often see fds open on pipes, and the notation is like:

    3 -> pipe:[123456]

    where 123456 is a sequence of usually between 6 and 8 digits. My question >is: To what does this number map? What does it mean?


    First guess, the pid of the process on the other side of the pipe (which
    may be the same process or a child process).

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kenny McCormack@21:1/5 to All on Thu Sep 16 16:43:17 2021
    When I do: ls -lsa /proc/<pid>/fd
    I often see fds open on pipes, and the notation is like:

    3 -> pipe:[123456]

    where 123456 is a sequence of usually between 6 and 8 digits. My question
    is: To what does this number map? What does it mean?

    Almost certainly, there is something else in /proc that contains this
    number and identifies the pipe in use. Usually, I'm pretty good about
    sussing things like this out - usually the answer is in "man /proc", but
    this one has me stumped.

    --
    The people who tell us to be proud of the white race are the ones who make
    us the most embarrassed by it.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Rainer Weikusat@21:1/5 to Scott Lurndal on Thu Sep 16 18:06:04 2021
    scott@slp53.sl.home (Scott Lurndal) writes:
    gazelle@shell.xmission.com (Kenny McCormack) writes:
    When I do: ls -lsa /proc/<pid>/fd
    I often see fds open on pipes, and the notation is like:

    3 -> pipe:[123456]

    where 123456 is a sequence of usually between 6 and 8 digits. My question >>is: To what does this number map? What does it mean?


    First guess, the pid of the process on the other side of the pipe (which
    may be the same process or a child process).

    It's the inode number of the pipe.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kenny McCormack@21:1/5 to ralfixx@gmx.de on Thu Sep 16 17:43:27 2021
    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel <ralfixx@gmx.de> wrote: ...
    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH

    It pretty much tells me things I already knew.

    What I'm looking for is "What can I do with this number?" You say it is an "inode" number, but I doubt it is matches to a file in the file system.
    I.e., you would do: find / -inum 123456 -ls

    Longer term, what I am really looking for is "Who is on the other end of
    this pipe?"

    --
    The randomly chosen signature file that would have appeared here is more than 4 lines long. As such, it violates one or more Usenet RFCs. In order to remain in compliance with said RFCs, the actual sig can be found at the following URL:
    http://user.xmission.com/~gazelle/Sigs/RightWingMedia

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ralf Fassel@21:1/5 to All on Thu Sep 16 19:33:04 2021
    * gazelle@shell.xmission.com (Kenny McCormack)
    | When I do: ls -lsa /proc/<pid>/fd
    | I often see fds open on pipes, and the notation is like:

    | 3 -> pipe:[123456]

    | where 123456 is a sequence of usually between 6 and 8 digits. My
    | question is: To what does this number map? What does it mean?

    https://man7.org/linux/man-pages/man5/proc.5.html
    [...]
    /proc/[pid]/fd/
    This is a subdirectory containing one entry for each file
    which the process has open, named by its file descriptor,
    and which is a symbolic link to the actual file. Thus, 0
    is standard input, 1 standard output, 2 standard error,
    and so on.

    For file descriptors for pipes and sockets, the entries
    will be symbolic links whose content is the file type with
    the inode. A readlink(2) call on this file returns a
    string in the format:

    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH
    R'

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Rainer Weikusat@21:1/5 to Kenny McCormack on Thu Sep 16 18:45:31 2021
    gazelle@shell.xmission.com (Kenny McCormack) writes:
    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel <ralfixx@gmx.de> wrote: ...
    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH

    It pretty much tells me things I already knew.

    What I'm looking for is "What can I do with this number?" You say it is an "inode" number, but I doubt it is matches to a file in the file system.
    I.e., you would do: find / -inum 123456 -ls

    Longer term, what I am really looking for is "Who is on the other end of
    this pipe?"

    Assuming you know the inode number, lsof | grep <inode number> will tell
    you that (ls -l /prroc/*/fd | grep ...).

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Nicolas George@21:1/5 to All on Thu Sep 16 18:01:52 2021
    Scott Lurndal, dans le message <9xK0J.78844$g81.64975@fx33.iad>, a
    écrit :
    First guess, the pid of the process on the other side of the pipe

    There is absolutely no chance of that, since several processes can have the same file descriptor.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ralf Fassel@21:1/5 to All on Fri Sep 17 10:50:01 2021
    * gazelle@shell.xmission.com (Kenny McCormack)
    | Longer term, what I am really looking for is "Who is on the other end
    | of this pipe?"

    I just did a

    $ cat | cat

    $ ps -ef | grep cat
    UID PID PPID C STIME TTY TIME CMD
    user 28788 28758 0 10:42 pts/4 00:00:00 cat
    user 28789 28758 0 10:42 pts/4 00:00:00 cat

    $ ls -l /proc/28788/fd
    l-wx------ 1 user group 64 Sep 17 10:42 1 -> pipe:[6418237]

    $ ls -l /proc/28789/fd
    lr-x------ 1 user group 64 Sep 17 10:42 0 -> pipe:[6418237]

    While there seems to be no file on /proc with that inode:

    $ find /proc -inum 6418237 2>/dev/null
    [nada]

    you could ls -l /proc/*/fd and check for the same inode listed in the
    last field. Don't know how bullet-proof this is...

    R'

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Eric Pozharski@21:1/5 to Kenny McCormack on Fri Sep 17 09:32:50 2021
    with <shvvnv$2667d$1@news.xmission.com> Kenny McCormack wrote:
    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel <ralfixx@gmx.de> wrote:

    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH

    It pretty much tells me things I already knew.

    What I'm looking for is "What can I do with this number?" You say it
    is an "inode" number, but I doubt it is matches to a file in the file
    system. I.e., you would do: find / -inum 123456 -ls

    Longer term, what I am really looking for is "Who is on the other end
    of this pipe?"

    If it's listening, then probably nothing. Anyway, quick grep through
    'man lsof' suggests '/proc/net/unix'.

    --
    Torvalds' goal for Linux is very simple: World Domination
    Stallman's goal for GNU is even simpler: Freedom

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Rainer Weikusat@21:1/5 to Eric Pozharski on Fri Sep 17 18:59:47 2021
    Eric Pozharski <whynot@pozharski.name> writes:
    with <shvvnv$2667d$1@news.xmission.com> Kenny McCormack wrote:
    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel <ralfixx@gmx.de> wrote:

    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH

    It pretty much tells me things I already knew.

    What I'm looking for is "What can I do with this number?" You say it
    is an "inode" number, but I doubt it is matches to a file in the file
    system. I.e., you would do: find / -inum 123456 -ls

    Longer term, what I am really looking for is "Who is on the other end
    of this pipe?"

    If it's listening, then probably nothing. Anyway, quick grep through
    'man lsof' suggests '/proc/net/unix'.

    A pipe is not a UNIX domain socket (listed in /proc/net/unix).

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Lew Pitcher@21:1/5 to Kenny McCormack on Fri Sep 17 19:33:45 2021
    On Thu, 16 Sep 2021 17:43:27 +0000, Kenny McCormack wrote:

    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel <ralfixx@gmx.de> wrote: ...
    type:[inode]

    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to
    find more information in one of the files under
    /proc/net/.

    HTH

    It pretty much tells me things I already knew.

    What I'm looking for is "What can I do with this number?" You say it is an "inode" number, but I doubt it is matches to a file in the file system.
    I.e., you would do: find / -inum 123456 -ls

    Longer term, what I am really looking for is "Who is on the other end of
    this pipe?"

    Sorry, but I don't think you will be able to answer that question directly.

    Apparently, from reading /usr/src/linux/fs/pipe.c, Linux implements pipes within a pseudo-filesystem called "pipefs". Those inode numbers refer to
    inodes within this pseudo-filesystem.

    According to Linux.org (among others),
    "Pipefs is a unique virtual filesystem. This filesystem is mounted
    inside the kernel rather than in the userspace. While most filesystems
    are mounted under "/", PipeFS is mounted on "pipe:", making PipeFS its
    own root (yes, a second root filesystem). This filesystem is one
    superblock and cannot exceed that amount system-wide. The entry point
    of this filesystem/second-root is the system-call "pipe()". Unlike
    the other virtual/pseudo filesystems, this one cannot be viewed." (https://www.linux.org/threads/pipefs-sockfs-debugfs-and-securityfs.9638/)

    So, those pipe inode numbers address inodes in a filesystem that is not externalized to /any/ subtree of /. This makes it difficult to use userland utilities (like find, for instance) on the pipefs, and thus makes analysis
    of individual pipe pairs /very/ difficult.

    IDK, but you /might/ be able to explicitly mount pipefs to some part of the filesystem tree. I can't guarantee that this will work, nor can I speculate
    on /if/ any userland utility would be able to access it to provide you with
    the information you seek.

    HTH
    --
    Lew Pitcher
    "In Skills, We Trust"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Eric Pozharski@21:1/5 to Weikusat on Sat Sep 18 12:45:16 2021
    with <87tuijaxrg.fsf@doppelsaurus.mobileactivedefense.com> Rainer
    Weikusat wrote:
    Eric Pozharski <whynot@pozharski.name> writes:
    with <shvvnv$2667d$1@news.xmission.com> Kenny McCormack wrote:
    In article <yga8rzw4e9b.fsf@akutech.de>, Ralf Fassel
    <ralfixx@gmx.de> wrote:

    *SKIP*
    For example, socket:[2248868] will be a socket and its
    inode is 2248868. For sockets, that inode can be used to >>>> find more information in one of the files under
    /proc/net/.
    It pretty much tells me things I already knew.
    What I'm looking for is "What can I do with this number?" You say
    it is an "inode" number, but I doubt it is matches to a file in the
    file system. I.e., you would do: find / -inum 123456 -ls
    Longer term, what I am really looking for is "Who is on the other
    end of this pipe?"
    If it's listening, then probably nothing. Anyway, quick grep through
    'man lsof' suggests '/proc/net/unix'.
    A pipe is not a UNIX domain socket (listed in /proc/net/unix).

    Indeed (as you can see, pipes quickly diverted to sockets as easier
    targets). As pointed out in <si2qip$8e1$1@dont-email.me> pipes don't
    manifest in something like /proc/net/unix. Scanning through
    /proc/[0-9]*/fd/* then.

    --
    Torvalds' goal for Linux is very simple: World Domination
    Stallman's goal for GNU is even simpler: Freedom

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kenny McCormack@21:1/5 to rweikusat@talktalk.net on Mon Sep 20 18:54:06 2021
    In article <87v930ct38.fsf@doppelsaurus.mobileactivedefense.com>,
    Rainer Weikusat <rweikusat@talktalk.net> wrote:
    ...
    Longer term, what I am really looking for is "Who is on the other end of
    this pipe?"

    Assuming you know the inode number, lsof | grep <inode number> will tell
    you that (ls -l /prroc/*/fd | grep ...).

    Yeah, it may come to that.

    But I was hoping for more of a "metal detector" type solution, rather than searching the entire haystack looking for the needle. I.e., more of a "go here" answer, than a "polling" answer.

    But, thanks...

    --
    Modern Conservative: Someone who can take time out from demanding more
    flag burning laws, more abortion laws, more drug laws, more obscenity
    laws, and more police authority to make warrantless arrests to remind
    us that we need to "get the government off our backs".

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kenny McCormack@21:1/5 to lew.pitcher@digitalfreehold.ca on Mon Sep 20 18:54:42 2021
    In article <si2qip$8e1$1@dont-email.me>,
    Lew Pitcher <lew.pitcher@digitalfreehold.ca> wrote:
    ...
    Sorry, but I don't think you will be able to answer that question directly.

    Yeah, that's kinda what I feared.

    --
    The coronavirus is the first thing, in his 74 pathetic years of existence,
    that the orange menace has come into contact with, that he couldn't browbeat, bully, bullshit, bribe, sue, legally harrass, get Daddy to fix, get his siblings to bail him out of, or, if all else fails, simply wish it away.

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Kenny McCormack@21:1/5 to lew.pitcher@digitalfreehold.ca on Mon Sep 27 13:49:28 2021
    In article <si2qip$8e1$1@dont-email.me>,
    Lew Pitcher <lew.pitcher@digitalfreehold.ca> wrote:
    ...
    IDK, but you /might/ be able to explicitly mount pipefs to some part of the >filesystem tree. I can't guarantee that this will work, nor can I speculate >on /if/ any userland utility would be able to access it to provide you with >the information you seek.

    # mkdir /tmp/ook
    # mount -t pipefs none /tmp/ook
    mount: /tmp/ook: wrong fs type, bad option, bad superblock on none, missing codepage or helper program, or other error.
    # mount -t pipes none /tmp/ook
    mount: /tmp/ook: unknown filesystem type 'pipes'.
    # mount -t proc none /tmp/ook
    #

    --
    Indeed, most .NET developers couldn't pass CS101 at a third-rate
    community college.
    - F. Russell -

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)