Linux /proc question (re: Pipes)

[Kenny McCormack]

When I do: ls -lsa /proc/<pid>/fd
I often see fds open on pipes, and the notation is like:

3 -> pipe:[123456]

where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?

Almost certainly, there is something else in /proc that contains this
number and identifies the pipe in use. Usually, I'm pretty good about
sussing things like this out - usually the answer is in "man /proc", but
this one has me stumped.

[Scott Lurndal]

Post by Kenny McCormack
When I do: ls -lsa /proc/<pid>/fd
3 -> pipe:[123456]
where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?

First guess, the pid of the process on the other side of the pipe (which
may be the same process or a child process).

[Rainer Weikusat]

Post by Scott Lurndal

Post by Kenny McCormack
When I do: ls -lsa /proc/<pid>/fd
3 -> pipe:[123456]
where 123456 is a sequence of usually between 6 and 8 digits. My question
is: To what does this number map? What does it mean?

First guess, the pid of the process on the other side of the pipe (which
may be the same process or a child process).

It's the inode number of the pipe.

[Nicolas George]

Post by Scott Lurndal
First guess, the pid of the process on the other side of the pipe

There is absolutely no chance of that, since several processes can have the
same file descriptor.

[Ralf Fassel]

* ***@shell.xmission.com (Kenny McCormack)
| When I do: ls -lsa /proc/<pid>/fd
| I often see fds open on pipes, and the notation is like:
| 3 -> pipe:[123456]
| where 123456 is a sequence of usually between 6 and 8 digits. My
| question is: To what does this number map? What does it mean?

https://man7.org/linux/man-pages/man5/proc.5.html
[...]
/proc/[pid]/fd/
This is a subdirectory containing one entry for each file
which the process has open, named by its file descriptor,
and which is a symbolic link to the actual file. Thus, 0
is standard input, 1 standard output, 2 standard error,
and so on.

For file descriptors for pipes and sockets, the entries
will be symbolic links whose content is the file type with
the inode. A readlink(2) call on this file returns a
string in the format:

type:[inode]

For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.

HTH
R'

[Kenny McCormack]

In article <***@akutech.de>, Ralf Fassel <***@gmx.de> wrote:
...

Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH

It pretty much tells me things I already knew.

What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls

Longer term, what I am really looking for is "Who is on the other end of
this pipe?"

[Rainer Weikusat]

Post by Kenny McCormack
...

Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH

It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"

Assuming you know the inode number, lsof | grep <inode number> will tell
you that (ls -l /prroc/*/fd | grep ...).

[Kenny McCormack]

In article <***@doppelsaurus.mobileactivedefense.com>,
Rainer Weikusat <***@talktalk.net> wrote:
...

Post by Rainer Weikusat

Post by Kenny McCormack
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"

Assuming you know the inode number, lsof | grep <inode number> will tell
you that (ls -l /prroc/*/fd | grep ...).

Yeah, it may come to that.

But I was hoping for more of a "metal detector" type solution, rather than
searching the entire haystack looking for the needle. I.e., more of a "go
here" answer, than a "polling" answer.

But, thanks...

[Ralf Fassel]

* ***@shell.xmission.com (Kenny McCormack)
| Longer term, what I am really looking for is "Who is on the other end
| of this pipe?"

I just did a

$ cat | cat

$ ps -ef | grep cat
UID PID PPID C STIME TTY TIME CMD
user 28788 28758 0 10:42 pts/4 00:00:00 cat
user 28789 28758 0 10:42 pts/4 00:00:00 cat

$ ls -l /proc/28788/fd
l-wx------ 1 user group 64 Sep 17 10:42 1 -> pipe:[6418237]

$ ls -l /proc/28789/fd
lr-x------ 1 user group 64 Sep 17 10:42 0 -> pipe:[6418237]

While there seems to be no file on /proc with that inode:

$ find /proc -inum 6418237 2>/dev/null
[nada]

you could ls -l /proc/*/fd and check for the same inode listed in the
last field. Don't know how bullet-proof this is...

R'

[Eric Pozharski]

Post by Kenny McCormack

Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH

It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it
is an "inode" number, but I doubt it is matches to a file in the file
system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end
of this pipe?"

If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.

[Rainer Weikusat]

Post by Eric Pozharski

Post by Kenny McCormack

Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH

It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it
is an "inode" number, but I doubt it is matches to a file in the file
system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end
of this pipe?"

If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.

A pipe is not a UNIX domain socket (listed in /proc/net/unix).

[Eric Pozharski]

*SKIP*

Post by Rainer Weikusat

Post by Eric Pozharski

Post by Kenny McCormack

Post by Ralf Fassel
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.

It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say
it is an "inode" number, but I doubt it is matches to a file in the
file system. I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other
end of this pipe?"

If it's listening, then probably nothing. Anyway, quick grep through
'man lsof' suggests '/proc/net/unix'.

A pipe is not a UNIX domain socket (listed in /proc/net/unix).

Indeed (as you can see, pipes quickly diverted to sockets as easier
targets). As pointed out in <si2qip$8e1$***@dont-email.me> pipes don't
manifest in something like /proc/net/unix. Scanning through
/proc/[0-9]*/fd/* then.

[Lew Pitcher]

Post by Kenny McCormack
...

Post by Ralf Fassel
type:[inode]
For example, socket:[2248868] will be a socket and its
inode is 2248868. For sockets, that inode can be used to
find more information in one of the files under
/proc/net/.
HTH

It pretty much tells me things I already knew.
What I'm looking for is "What can I do with this number?" You say it is an
"inode" number, but I doubt it is matches to a file in the file system.
I.e., you would do: find / -inum 123456 -ls
Longer term, what I am really looking for is "Who is on the other end of
this pipe?"

Sorry, but I don't think you will be able to answer that question directly.

Apparently, from reading /usr/src/linux/fs/pipe.c, Linux implements pipes
within a pseudo-filesystem called "pipefs". Those inode numbers refer to
inodes within this pseudo-filesystem.

According to Linux.org (among others),
"Pipefs is a unique virtual filesystem. This filesystem is mounted
inside the kernel rather than in the userspace. While most filesystems
are mounted under "/", PipeFS is mounted on "pipe:", making PipeFS its
own root (yes, a second root filesystem). This filesystem is one
superblock and cannot exceed that amount system-wide. The entry point
of this filesystem/second-root is the system-call "pipe()". Unlike
the other virtual/pseudo filesystems, this one cannot be viewed."
(https://www.linux.org/threads/pipefs-sockfs-debugfs-and-securityfs.9638/)

So, those pipe inode numbers address inodes in a filesystem that is not
externalized to /any/ subtree of /. This makes it difficult to use userland
utilities (like find, for instance) on the pipefs, and thus makes analysis
of individual pipe pairs /very/ difficult.

IDK, but you /might/ be able to explicitly mount pipefs to some part of the
filesystem tree. I can't guarantee that this will work, nor can I speculate
on /if/ any userland utility would be able to access it to provide you with
the information you seek.

HTH

[Kenny McCormack]

In article <si2qip$8e1$***@dont-email.me>,
Lew Pitcher <***@digitalfreehold.ca> wrote:
...

Post by Lew Pitcher
Sorry, but I don't think you will be able to answer that question directly.

Yeah, that's kinda what I feared.

[Kenny McCormack]

In article <si2qip$8e1$***@dont-email.me>,
Lew Pitcher <***@digitalfreehold.ca> wrote:
...

Post by Lew Pitcher
IDK, but you /might/ be able to explicitly mount pipefs to some part of the
filesystem tree. I can't guarantee that this will work, nor can I speculate
on /if/ any userland utility would be able to access it to provide you with
the information you seek.

# mkdir /tmp/ook
# mount -t pipefs none /tmp/ook
mount: /tmp/ook: wrong fs type, bad option, bad superblock on none, missing codepage or helper program, or other error.
# mount -t pipes none /tmp/ook
mount: /tmp/ook: unknown filesystem type 'pipes'.
# mount -t proc none /tmp/ook
#