Question

I have the code below for getting a list of child processes on windows by interop’ing with ntdll. Is there an equivalent to ‘NtQueryInformationProcess’ on Linux, which get’s me the process id of the parent of a specified process (like pbi.InheritedFromUniqueProcessId)? I need the code to run on Linux through Mono so hopefully I am hoping I need to change only the part where I get the parent process ID so the code stays mostly the same as on Windows.

public IList< Process > GetChildren( Process parent )
    {
        List< Process > children = new List< Process >();

        Process[] processes = Process.GetProcesses();
        foreach (Process p in processes)
        {
            ProcessBasicInformation pbi = new ProcessBasicInformation();
            try
            {
                uint bytesWritten;
                NtQueryInformationProcess(p.Handle,
                  0, ref pbi, (uint)Marshal.SizeOf(pbi),
                  out bytesWritten); // == 0 is OK

                if (pbi.InheritedFromUniqueProcessId == parent.Id)
                    children.AddRange(GetChildren(p));
            }
            catch
            {
            }
        }

        return children;
    }

Answer 1

One way of finding all the children of a given process in Linux is to do something like this inside your foreach:

string line;
using (StreamReader reader = new StreamReader ("/proc/" + p.Id + "/stat")) {
      line = reader.ReadLine ();
}
string [] parts = line.Split (new char [] {' '}, 5); // Only interested in field at position 3
if (parts.Legth >= 4) {
    int ppid = Int32.Parse (parts [3]);
    if (ppid == parent.Id) {
         // Found a children
    }
}

For more information on what /proc/[id]/stat contains, see the manual page for ‘proc’. You should also add a try/catch around the ‘using’ because the process might die before we open the file, etc…