7

Everything I've seen says to use lsof -p, but I'm looking for something that doesn't require a fork/exec.

For example on Linux one can simply walk /proc/{pid}/fd.

bdash
  • 18,110
  • 1
  • 59
  • 91
fmoo
  • 769
  • 5
  • 11
  • 1
    Have you checked out the [lsof source code](http://people.freebsd.org/~abe/)? – autistic Mar 23 '13 at 05:49
  • I dug into it for 15 minutes or so, but I am pretty terrible at C and couldn't make much sense of it. I'll keep poking at it, and if I come up with something, I'll post it as an answer myself :) – fmoo Mar 23 '13 at 05:55

1 Answers1

9

You can use proc_pidinfo with the PROC_PIDLISTFDS option to enumerate the files used by a given process. You can then use proc_pidfdinfo on each file in turn with the PROC_PIDFDVNODEPATHINFO option to get its path.

bdash
  • 18,110
  • 1
  • 59
  • 91
  • Are there any good man pages or other documentation on this API? I've been ctags-ing my way round /usr/include and read that example you provided, but it's pretty terse. – fmoo Mar 23 '13 at 07:06
  • There's not any documentation that I'm aware. `sys/proc_info.h` seems relatively self-explanatory in terms of interpreting the information available from the system calls, and the implementation of the system calls is available in the kernel open source if you want to understand more about how it all works. – bdash Mar 23 '13 at 07:15