Security Tip: Find out current working directory of a process

by Vivek Gite · 3 comments

For security reason you may need to find out current working directory of a process. You can obtained this information by visiting /proc/pid/cwd directory or using the pwdx command. It reports the current working directory of a process or processes.

Find out out working directory for a process

Run ps aux to find out PID of a process:
$ ps aux | grep {process-name}

To find out current working directory of a PID 13456:
$ pwdx 13456
Output:
13456: /tmp/.xy

Look like someone try to hide process (PID # 13456) /tmp/.xy directory. You can also run command:
$ ls -l /proc/13456/cwd
Output:
lrwxrwxrwx 1 apache apache 0 Nov 14 05:30 /proc/13456/cwd -> /tmp/.xy

Featured Articles:

Want to read Linux tips and tricks, but don't have time to check our blog everyday? Subscribe to our daily email newsletter to make sure you don't miss a single tip/tricks. Subscribe to our weekly newsletter here!

{ 3 comments… read them below or add one }

1 virens 11.14.07 at 8:22 pm

Great thing, I usually use lsof | grep whtaiwant. Thanks!

2 vivek 11.15.07 at 1:19 am

yup, lsof is a nifty tool for admins.

3 Gagan Brahmi 11.23.07 at 10:31 pm

Hey Vivek,

You can add the lsof command for this as well.

# lsof -p 13456|more

The more option over here is to make sure you don’t run out to the next page as the current working directory will be displayed right at the top.

Leave a Comment

You can use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Previous post:

Next post: