Finding the full path of a process binary using /proc

Question

Hello,
I have an application where I need to monitor whether a certain other process is running. I'm using the /proc filesystem and an ioctl call - namely, PIOCPSINFO - to fetch process information into a prpsinfo_t, then use either the pr_fname field for the base name of the process executable or pr_psargs for the full launch command line - the first argument being the executable name. However, I see that if I launch something like "man chmod" in the shell, the pr_psargs for that process is "man chmod", not "/usr/bin/man chmod", thus making it hard to distinguish between binaries which have the same base name, but can be run from different locations (e.g. /usr/ccs/bin/make and /usr/local/bin/make). Is there some way to find out the environment (actually, the PATH variable) that a process has been run with? I see there's an 'uintptr_t pr_envp' in pr_psinfo_t that is supposed to be the "address of initial environment vector". How can I use that?

Answer 1

I believe you have to open the processes 'map' file and use the envp address
as an index into that file. It's the address inside the target process.
The problem is that (until recent S10 release) the kernel doesn't actually
remember the pathname that was used to open the binary. There is
no guarantee that the binary is actually the first one on the search path
that's just a convention followed by most shells. If the program was
explicitly exec'ed by another program, it might not even be on the search path.
However, you can get an open file descriptior on the executable binary
by using a /proc interface.
If you know the file that you are looking for there is another way:
- open the binary you're looking for (/bin/ls)
- get device/inode of this file (using stat)
- seach processes that "look" like they might be the one you want
- for each one:
get FD of binary using /proc
stat the FD to get device/inode
compare to device/inode from the binary you're looking for
This is a bunch more work, but it's the only way to be sure.
It's better to avoid the whole mess and find a better way.
it's better to let an OS utility do the /proc mucking. They are
more likely to get it right. /proc is pretty complicated. And if you
using it ways that haven't been tested before, you can find
interesting problems.
You could just run 'ps|grep' or the 'pgrep' command.
Here is a short demo of how to compare inodes:
% ls -i /proc/$$/object/a.out
97634 /proc/9120/object/a.out <--- always called a.out, no matter the binary name
% ls -i /bin/bash
97634 /bin/bash <-- notice the same inode number
This means /bin/bash is the executable being used for my current shell.