1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
.\" Copyright (C) 1994, 1995, Daniel Quinlan <quinlan@yggdrasil.com>
.\" Copyright (C) 2002-2008, 2017, Michael Kerrisk <mtk.manpages@gmail.com>
.\" Copyright (C) 2023, Alejandro Colomar <alx@kernel.org>
.\"
.\" SPDX-License-Identifier: GPL-3.0-or-later
.\"
.TH proc_pid_exe 5 2023-08-15 "Linux man-pages 6.7"
.SH NAME
/proc/pid/exe \- symbolic link to program pathname
.SH DESCRIPTION
.TP
.IR /proc/ pid /exe
Under Linux 2.2 and later, this file is a symbolic link
containing the actual pathname of the executed command.
This symbolic link can be dereferenced normally; attempting to open
it will open the executable.
You can even type
.IR /proc/ pid /exe
to run another copy of the same executable that is being run by
process
.IR pid .
If the pathname has been unlinked, the symbolic link will contain the
string \[aq]\ (deleted)\[aq] appended to the original pathname.
.\" The following was still true as at kernel 2.6.13
In a multithreaded process, the contents of this symbolic link
are not available if the main thread has already terminated
(typically by calling
.BR pthread_exit (3)).
.IP
Permission to dereference or read
.RB ( readlink (2))
this symbolic link is governed by a ptrace access mode
.B PTRACE_MODE_READ_FSCREDS
check; see
.BR ptrace (2).
.IP
Under Linux 2.0 and earlier,
.IR /proc/ pid /exe
is a pointer to the binary which was executed,
and appears as a symbolic link.
A
.BR readlink (2)
call on this file under Linux 2.0 returns a string in the format:
.IP
.in +4n
.EX
[device]:inode
.EE
.in
.IP
For example, [0301]:1502 would be inode 1502 on device major 03 (IDE,
MFM, etc. drives) minor 01 (first partition on the first drive).
.IP
.BR find (1)
with the
.I \-inum
option can be used to locate the file.
.SH SEE ALSO
.BR proc (5)
|
