For today's #Linux #DFIR #CommandLine #Trivia I want a command to produce a sorted list of the executable paths for all running processes on the system.

Nov 12, 2022 · 1:47 PM UTC

5
10
The first and best answer to yesterday's #Linux #DFIR #CommandLine #Trivia comes from Linkavych: readlink -f /proc/＊/exe | sort The first lesson here is never be afraid to get the answers you need directly from /proc. This saves a lot of… infosec.exchange/@hal_pomera…

Hal Pomeranz (@hal_pomeranz@infosec.exchange)

The first and best answer to yesterday's #Linux #DFIR #CommandLine #Trivia comes from @Linkavych@twitter.com: readlink -f /proc/*/exe | sort The first lesson here is never be afraid to get the...

infosec.exchange
2
10
Replying to @hal_pomeranz
fun! I started with a find, but it seemed clunky.. for loop unnecessary as well, but I like to be able to add ideas once I think of more stuff.. for exe in /proc/[0-9]*/exe do readlink $exe done | sort -u
1
Replying to @hal_pomeranz
egrep -v /dev/null /proc/*/exe | while read magic type myfile result; do pid=$( basename $( dirname $myfile ) ); exepath=$( readlink $myfile ); ech o $pid $exepath; done
Replying to @hal_pomeranz
Admittedly somewhat baroque, but you get the context ( pid and exepath ) and then you can filter out the self process.
Replying to @hal_pomeranz
Maybe: /usr/bin/readlink -f /proc/*/exe | grep -v readlink | sort
1