Home/ Questions/Q 6603871
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T19:04:25+00:00

I’m working on security software(SW) for Linux. One thing that our SW does on

  • 0

I’m working on security software(SW) for Linux.
One thing that our SW does on is that when some process is started, the SW stat()s the process’s /proc/ entry and remembers the entry’s inode number.
When later on the SW needs to ascertain that the process is still running (and hasn’t been restarted), it again looks up process’s inode and compares to the one remembered.
All was fine and dandy until recently I began receiving false alerts for a specifc application – Opera browser 11.10beta.
Basically it appears that while Opera was running, the inode number for its /proc/PID entry has changed, which we considered an impossibility.
This is a rather big spanner in the works of the SW’s security concept – so much relied on the fact that while a process is running, its /proc/ entry’s inode remains unchanged.

Could someone please advise as to why such behaviour may be exhibited.
Thanks.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Thanks to sehe for pointing in the right direction and to Random832 for finally nailing it.
    I ran a process and monitored its PID ls -i /proc/21314 . Alas! Every single entry under that directory had its inode number changed after approx. 15 minutes.
    So inode numbers were never meant to be permanent in procfs 🙁

    • 0