That raises the question of how their ps, top, lsof and such work, since afaik in Linux they read from /proc.
P.S. Looks like BSDs tug at the kernel via syscalls, namely sysctl and also the ‘kvm interface’ in the case of MacOS (not sure what ‘kvm’ thing is meant here). Seems vaguely reasonable, since procfs also queries the kernel for the info, so about the same resources would be used, perhaps even with the overhead of filesystem traversal and string-numbers conversion.
Some pseudofiles under /proc are only readable by the user running the process, and of course root can read everything. So it’s the standard Unix security model, afaics.
For example, any process’ command-line arguments are famously visible to everyone, while the environment variables only to the user of the process.
That raises the question of how their
ps,top,lsofand such work, since afaik in Linux they read from /proc.P.S. Looks like BSDs tug at the kernel via syscalls, namely
sysctland also the ‘kvm interface’ in the case of MacOS (not sure what ‘kvm’ thing is meant here). Seems vaguely reasonable, since procfs also queries the kernel for the info, so about the same resources would be used, perhaps even with the overhead of filesystem traversal and string-numbers conversion.I might be mistaken, but I think kvm stands for kernel virtual machine. Having no /proc, and interacting with sysctl instead sounds more secure, IMO.
Some pseudofiles under /proc are only readable by the user running the process, and of course root can read everything. So it’s the standard Unix security model, afaics.
For example, any process’ command-line arguments are famously visible to everyone, while the environment variables only to the user of the process.