proc(5)

✨ NAME ✨

proc — process information, system information, and sysctl pseudo-filesystem 🫶

okay bestie, quick vibe check: this is proc(5), from the File Formats Manual section of the man pages. it's the page about the whole /proc situation. let's go 💅

---

🦋 DESCRIPTION 🦋

so the proc filesystem is a pseudo-filesystem — like, it's not real files on a disk, it's a window straight into kernel data structures ✨ it's commonly mounted at /proc. typically the system mounts it for you automatically (main character behavior tbh), but you can also mount it manually with a command like:

mount -t proc proc /proc

most of the files in /proc are read-only 🥺 but some of them are writable, which means you can actually change kernel variables through them. putting your hands directly on the machinery fr fr.

🎀 Mount options

the proc filesystem supports these mount options:

• hidepid=n (since Linux 3.3) — this one controls who can access the info inside the /proc/pid directories 👀 the argument, n, is one of these values:
  • 0 — literally everybody can access all /proc/pid directories. this is the traditional behavior, and it's the default if you don't specify this mount option at all.
  • 1 — users may not access files and subdirectories inside any /proc/pid directories except their own (the /proc/pid directories themselves stay visible, they're just empty-looking for outsiders). sensitive files like /proc/pid/cmdline and /proc/pid/status are now protected against other users 🔒 this makes it impossible to learn whether any user is running a specific program — well, as long as that program doesn't betray itself by its behavior 🙈
  • 2 — same as mode 1, but on top of that the /proc/pid directories belonging to other users become completely invisible 💀 so /proc/pid entries can no longer be used to discover the PIDs on the system. heads up though: this doesn't hide the fact that a process with a specific PID value exists — that can be learned by other means, for example by "kill -0 $PID" — but it does hide a process's UID and GID, which you could otherwise learn by using stat(2) on a /proc/pid directory. this greatly complicates an attacker's job of gathering info about running processes (like: discovering whether some daemon is running with elevated privileges, whether another user is running some sensitive program, whether other users are running any program at all, etc.). iconique security behavior 👑
  • gid=gid (since Linux 3.3) — specifies the ID of a group whose members are authorized to learn process information that would otherwise be prohibited by hidepid (i.e., users in this group behave as though /proc was mounted with hidepid=0). this group should be used instead of approaches like putting nonroot users into the sudoers(5) file. cleaner, safer, slay.
• subset=pid (since Linux 5.8) — show only the specified subset of procfs, hiding all the top level files and directories in procfs that aren't related to tasks 🌈

---

💖 FILES 💖

underneath /proc, there are these general groups of files and subdirectories:

/proc/pid subdirectories

see proc_pid(5) ✨

each one of these subdirectories contains files and subdirectories exposing information about the process with the corresponding process ID.

underneath each of the /proc/pid directories, there's a task subdirectory that contains subdirectories of the form task/tid, which contain corresponding information about each of the threads in the process, where tid is the kernel thread ID of the thread 🧵

the /proc/pid subdirectories are visible when iterating through /proc with getdents(2) (and thus they're visible when you use ls(1) to view the contents of /proc).

/proc/tid subdirectories

see proc_tid(5) ✨

each one of these subdirectories contains files and subdirectories exposing information about the thread with the corresponding thread ID. the contents of these directories are the same as the corresponding /proc/pid/task/tid directories.

the /proc/tid subdirectories are not visible when iterating through /proc with getdents(2) (and thus they're not visible when you use ls(1) to view the contents of /proc). sneaky 🙈

/proc/self

see proc_self(5) ✨

when a process accesses this magic symbolic link, it resolves to the process's own /proc/pid directory. it's giving "who am i, really" 🪞

/proc/thread-self

see proc_thread-self(5) ✨

when a thread accesses this magic symbolic link, it resolves to the process's own /proc/self/task/tid directory.

/proc/[a-z]*

various other files and subdirectories under /proc expose system-wide information 👑

see also:

• proc_apm(5)
• proc_buddyinfo(5)
• proc_bus(5)
• proc_cgroups(5)
• proc_cmdline(5)
• proc_config.gz(5)
• proc_cpuinfo(5)
• proc_crypto(5)
• proc_devices(5)
• proc_diskstats(5)
• proc_dma(5)
• proc_driver(5)
• proc_execdomains(5)
• proc_fb(5)
• proc_filesystems(5)
• proc_fs(5)
• proc_ide(5)
• proc_interrupts(5)
• proc_iomem(5)
• proc_ioports(5)
• proc_kallsyms(5)
• proc_kcore(5)
• proc_key-users(5)
• proc_keys(5)
• proc_kmsg(5)
• proc_kpagecgroup(5)
• proc_kpagecount(5)
• proc_kpageflags(5)
• proc_ksyms(5)
• proc_loadavg(5)
• proc_locks(5)
• proc_malloc(5)
• proc_meminfo(5)
• proc_modules(5)
• proc_mounts(5)
• proc_mtrr(5)
• proc_net(5)
• proc_partitions(5)
• proc_pci(5)
• proc_profile(5)
• proc_scsi(5)
• proc_slabinfo(5)
• proc_stat(5)
• proc_swaps(5)
• proc_sys(5)
• proc_sysrq-trigger(5)
• proc_sysvipc(5)
• proc_timer_list(5)
• proc_timer_stats(5)
• proc_tty(5)
• proc_uptime(5)
• proc_version(5)
• proc_vmstat(5)
• proc_zoneinfo(5)

---

🧚 NOTES 🧚

ngl, a lot of these files contain strings (like the environment and the command line) that are in the internal format, with subfields terminated by null bytes ('\0') 😭 so when you're inspecting such files, you might find the results are way more readable if you use a command of this form to display them:

$ cat file | tr '\000' '\n'

---

🌈 SEE ALSO 🌈

• cat(1), dmesg(1), find(1), free(1), htop(1), init(1), ps(1), pstree(1), tr(1), uptime(1), chroot(2), mmap(2), readlink(2), syslog(2), slabinfo(5), sysfs(5), hier(7), namespaces(7), time(7), arp(8), hdparm(8), ifconfig(8), lsmod(8), lspci(8), mount(8), netstat(8), procinfo(8), route(8), sysctl(8)

the Linux kernel source files: Documentation/filesystems/proc.rst, Documentation/admin-guide/sysctl/fs.rst, Documentation/admin-guide/sysctl/kernel.rst, Documentation/admin-guide/sysctl/net.rst, and Documentation/admin-guide/sysctl/vm.rst.

---

aaaand that's the whole page bestie 💖 this one came from Linux man-pages 6.20, dated 2026-09-09 — go forth and ls /proc responsibly, mwah 🎀