linux-kernel - [PATCH 2/2] Documentation/filesystems/proc.rst: document procfs inode timestamps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220722162934.1888835-3-mcgrof@kernel.org>
Date:   Fri, 22 Jul 2022 09:29:34 -0700
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     ebiederm@...ssion.com, corbet@....net, keescook@...omium.org,
        yzaikin@...gle.com
Cc:     songmuchun@...edance.com, zhangyuchen.lcr@...edance.com,
        dhowells@...hat.com, deepa.kernel@...il.com, hch@....de,
        mcgrof@...nel.org, linux-doc@...r.kernel.org,
        linux-api@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] Documentation/filesystems/proc.rst: document procfs inode timestamps

The timestamps for procfs files are not well understood and can
confuse users and developers [0] in particular for the timestamp
for the start time or a process. Clarify what they mean and that
they are a reflection of the ephemeral nature of the filesystem
inodes.

The procfs inodes are created when you first read them and then
stuffed in the page cache. If the page cache and indodes are
reclaimed they can be removed, and re-created with a new timestamp
after read again. Document this little bit of tribal knowledge.

[0] https://lkml.kernel.org/r/20220721081617.36103-1-zhangyuchen.lcr@bytedance.com
Reported-by: Zhang Yuchen <zhangyuchen.lcr@...edance.com>
Signed-off-by: Luis Chamberlain <mcgrof@...nel.org>
---
 Documentation/filesystems/proc.rst | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/Documentation/filesystems/proc.rst b/Documentation/filesystems/proc.rst
index 9fd5249f1a5f..9defe9af683a 100644
--- a/Documentation/filesystems/proc.rst
+++ b/Documentation/filesystems/proc.rst
@@ -59,6 +59,15 @@ The proc  file  system acts as an interface to internal data structures in the
 kernel. It  can  be  used to obtain information about the system and to change
 certain kernel parameters at runtime (sysctl).
 
+The proc files are dynamic in nature and allow for developers to make the
+content to be changed each time a file is read. The proc files and directories
+inodes are created when someone first reads a respective proc file or directory,
+as such the timestamps of the proc files reflect this time. As with other
+filesystems, these proc inodes can be removed through reclaim under memory
+pressure and so the timestamps of the proc files can change if the proc files
+are destroyed and re-created (echo 3 > /proc/sys/vm/drop_caches forces and
+illustrate the reclaim of inodes and page cache).
+
 First, we'll  take  a  look  at the read-only parts of /proc. In Chapter 2, we
 show you how you can use /proc/sys to change settings.
 
@@ -328,6 +337,13 @@ It's slow but very precise.
 		system call
   ============= ===============================================================
 
+Note that the start_time inside the stat file is different than the timestamp
+of the stat file itself. The timestamp of the stat file simply reflects the
+first time the stat file was read. The proc inode for this file can be reclaimed
+under memory pressure and be recreated after this and so the timestamp can
+change. Userspace should rely on the start_time entry in the the stat file to
+get a process start time.
+
 The /proc/PID/maps file contains the currently mapped memory regions and
 their access permissions.
 
-- 
2.35.1