procmaps

Documentation

Overview

Package procmaps parses /proc/<pid>/maps.

The pathname on a maps line is the entire remainder of the line and must never be read as a whitespace-separated field. The kernel emits it verbatim through seq_path and does not escape spaces, so a file named "libssl.so.3 X" produces a line whose sixth whitespace-separated token is "libssl.so.3" — the name of a different file that may well exist elsewhere. Taking that token lets the traced process choose which path the reader believes it mapped, which for a privileged reader that then attaches uprobes is a way out of the target's rootfs.

A pathname whose own leading characters are spaces cannot be recovered from this file at all, because the kernel pads to a fixed column with the same character. Callers that must be certain of the backing file should treat /proc/<pid>/map_files as authoritative and the pathname only as a hint.

Index

• type Entry
  • func Parse(data []byte) []Entry
  • func ParseLine(line string) (Entry, bool)
  • func (e Entry) Executable() bool
  • func (e Entry) Named() bool

Types

type Entry

type Entry struct {
	// AddrRange is the raw "<hex>-<hex>" column, which is also the name of
	// the corresponding /proc/<pid>/map_files entry.
	AddrRange string
	Start     uint64
	End       uint64
	Perms     string
	// Offset is the file offset the mapping starts at.
	Offset uint64
	// Path is the backing file's pathname with any " (deleted)" marker
	// removed, empty for an anonymous mapping.
	Path string
	// Deleted reports that the backing file has been unlinked.
	Deleted bool
}

Entry is one parsed line of /proc/<pid>/maps.

func Parse

func Parse(data []byte) []Entry

Parse parses the contents of a /proc/<pid>/maps file, skipping lines that do not have the expected shape.

func ParseLine

func ParseLine(line string) (Entry, bool)

ParseLine parses one line of /proc/<pid>/maps, reporting false when the line does not have the shape the kernel writes.

func (Entry) Executable

func (e Entry) Executable() bool

Executable reports whether the mapping carries the execute bit, i.e. holds the code segment a uprobe would attach to.

func (Entry) Named

func (e Entry) Named() bool

Named reports whether the entry is file-backed, as opposed to an anonymous mapping or a kernel pseudo-mapping such as [stack], [heap] or [vdso].