Inside /proc: Every Process Is a Folder

A folder that isn't on the disk

/proc looks like an ordinary folder, but nothing in it is stored anywhere: the kernel makes up its contents when you read them. Each number is the PID of a running process:

ls /proc | head -n 12

In the terminal

student@vulntech:~$ ls /proc | head -n 12
1
10
100
11
110
115
117
120
1251
1292
1294
13

Everything ps and top show, they read from here. Look inside the folder of your own shell:

ls /proc/$$

In the terminal

student@vulntech:~$ ls /proc/$$
arch_status      environ            map_files   oom_score_adj  stack
attr             exe                maps        pagemap        stat
autogroup        fd                 mem         personality    statm
auxv             fdinfo             mountinfo   projid_map     status
cgroup           gid_map            mounts      root           syscall
clear_refs       io                 mountstats  sched          task
cmdline          ksm_merging_pages  net         schedstat      timens_offsets
comm             ksm_stat           ns          sessionid      timers
coredump_filter  latency            numa_maps   setgroups      timerslack_ns
cpuset           limits             oom_adj     smaps          uid_map
cwd              loginuid           oom_score   smaps_rollup   wchan

What's inside

head -n 9 /proc/$$/status
ls -l /proc/$$/cwd /proc/$$/exe
ls -l /proc/$$/fd

In the terminal

student@vulntech:~$ head -n 9 /proc/$$/status
Name:	bash
Umask:	0022
State:	S (sleeping)
Tgid:	1294
Ngid:	0
Pid:	1294
PPid:	1292
TracerPid:	0
Uid:	1000	1000	1000	1000
student@vulntech:~$ ls -l /proc/$$/cwd /proc/$$/exe
lrwxrwxrwx 1 student student 0 Oct 17 15:00 /proc/1294/cwd -> /home/student
lrwxrwxrwx 1 student student 0 Oct 17 15:00 /proc/1294/exe -> /bin/bash
student@vulntech:~$ ls -l /proc/$$/fd
total 0
lrwx------ 1 student student 64 Oct 17 15:00 0 -> /dev/ttyS0
lrwx------ 1 student student 64 Oct 17 15:00 1 -> /dev/ttyS0
lrwx------ 1 student student 64 Oct 17 08:35 2 -> /dev/ttyS0
lrwx------ 1 student student 64 Oct 17 15:00 255 -> /dev/ttyS0

Your shell's input, output and errors (0, 1 and 2) all point at the terminal, /dev/ttyS0. The null characters in cmdline and environ don't print well; turn them into spaces or newlines with tr:

tr '\0' ' ' < /proc/$$/cmdline; echo
tr '\0' '\n' < /proc/$$/environ | head -n 4

In the terminal

student@vulntech:~$ tr '\0' ' ' < /proc/$$/cmdline; echo
-bash
student@vulntech:~$ tr '\0' '\n' < /proc/$$/environ | head -n 4
TERM=xterm-256color
HOME=/home/student
SHELL=/bin/bash
USER=student

Tip: cd into a process's folder and look around: cat any file, and ls -l shows where the links point.

Private: other users' processes

Anyone can read a process's status and cmdline, but only its owner (and root) can look at its environment, its open files and where it's working. Process 1 belongs to root:

cat /proc/1/environ
sudo ls -l /proc/1/cwd

In the terminal

student@vulntech:~$ cat /proc/1/environ
cat: /proc/1/environ: Permission denied
student@vulntech:~$ sudo ls -l /proc/1/cwd
[sudo] password for student:
lrwxrwxrwx 1 root root 0 Oct 17 15:00 /proc/1/cwd -> /

The whole machine

Files at the top of /proc describe the machine itself:

grep 'model name' /proc/cpuinfo
head -n 3 /proc/meminfo
cat /proc/uptime
cat /proc/version

In the terminal

student@vulntech:~$ grep 'model name' /proc/cpuinfo
model name	: Pentium III (Katmai)
student@vulntech:~$ head -n 3 /proc/meminfo
MemTotal:         222252 kB
MemFree:          187792 kB
MemAvailable:     204732 kB
student@vulntech:~$ cat /proc/uptime
1283.59 1153.36
student@vulntech:~$ cat /proc/version
Linux version 6.12.113-0-virt (buildozer@build-3-21-x86) (gcc (Alpine 14.2.0) 14.2.0, GNU ld (GNU Binutils) 2.43.1) #1-Alpine SMP PREEMPT_DYNAMIC 2026-10-16 12:36:33

/proc/uptime is the number of seconds since the machine started (the second number is how long the CPU has been idle). uptime and free simply read these files and make them easier to read.

Remember: /proc/PID/ holds a process's details: status, cmdline, cwd, exe, fd/, environ. The kernel creates them on the fly.