proc_pid_map_files(5)

๐ŸŒธ NAME ๐ŸŒธ

/proc/pid/map_files/ โ€” the memory-mapped files zone, bestie ๐Ÿ’–


โœจ DESCRIPTION โœจ

๐Ÿ—บ๏ธ /proc/pid/map_files/ (since Linux 3.3)

okay so this subdirectory is literally a lil guest list of every memory-mapped file, like the ones from mmap(2) ๐Ÿซถ

The entries are named by a memory region start and end address pair โ€” expressed as hexadecimal numbers โ€” and each one is a symbolic link pointing at the mapped file itself. iconic behavior honestly ๐Ÿ’…

Here's the moment, with the output wrapped and reformatted to fit on an 80-column display:

# ls -l /proc/self/map_files/
lr-------- 1 root root 64 Apr 16 21:31
            3252e00000-3252e20000 -> /usr/lib64/ld-2.15.so
...

nowโ€ฆ plot twist ๐Ÿ“ Even though these entries are there for memory regions that got mapped with the MAP_FILE flag, the way anonymous shared memory (regions created with the MAP_ANON | MAP_SHARED flags) is implemented in Linux means those regions also show up in this directory. not them crashing the party ๐Ÿ˜ญ

Here's an example where the target file is the deleted /dev/zero one:

lrw------- 1 root root 64 Apr 16 21:33
            7fc075d2f000-7fc075e6f000 -> /dev/zero (deleted)

Permission to access this file is governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check โ€” go peek at ptrace(2) for the deets ๐Ÿ‘‘

โณ heads up: until Linux 4.3, this directory only appeared if the CONFIG_CHECKPOINT_RESTORE kernel configuration option was enabled. so yeah, old kernels were gatekeeping ๐Ÿ™ˆ

and now the capabilities part, because of course there's a permissions moment ๐Ÿ’€ Capabilities are required to read the contents of the symbolic links in this directory:

  • before Linux 5.9 โ€” the reading process requires CAP_SYS_ADMIN in the initial user namespace
  • since Linux 5.9 โ€” the reading process must have either CAP_SYS_ADMIN or CAP_CHECKPOINT_RESTORE in the initial (i.e., root) user namespace

๐Ÿฆ‹ SEE ALSO ๐Ÿฆ‹


and that's the whole vibe check, bestie ๐Ÿ’œ this was the proc_pid_map_files(5) page from Linux man-pages 6.20, dated 2026-02-08 โ€” go forth and map those files, you absolute main character ๐ŸŒˆโœจ๐Ÿ‘‘

๐Ÿ“ฆ where this page comes from
  • arch rolling: man-pages 6.20-1 ยท BSD-2-Clause AND BSD-3-Clause AND BSD-4.3TAHOE AND BSD-4-Clause-UC AND GPL-1.0-or-later AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-3.0-linking-exception AND LGPL-3.0-or-later AND LicenseRef-Public-Domain AND LicenseRef-UltraPermissive AND Linux-man-pages-1-para AND Linux-man-pages-copyleft AND Linux-man-pages-copyleft-2-para AND Linux-man-pages-copyleft-var AND MIT AND Spencer-94
  • nixpkgs unstable: man-pages 6.20
  • ๐Ÿ“œ the page's license: GPL-3.0-or-later
  • ๐Ÿ’– girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms