Does `ps` provide the working directory of each process?

Question

Is it correct that the output of jobs contains the working directory when invoking each job (not necessarily the current working directory of each job)?

$ jobs -l | grep JDBC
[15]  20422 Running   PDFXCview all.pdf &  (wd: ~/mydata/dirlinks/cs/SQL/API/JDBC/general/official/tutorials)
[20]  20542 Running   PDFXCview all.pdf &  (wd: ~/mydata/dirlinks/cs/SQL/API/JDBC/general/wikipedia)

Similarly, in ps, is it possible to get the previous working directory of each process when invoking it

In pgrep, is it possible to search in the pathname (string) of the previous working directory of each process when invoking it, like pgrep ... <pattern_in_working_dir_pathname>?

I would like to search for processes, by keywords in their working directories when invoking them

Thanks.

Answer 1

The jobs command may show working directory the program started in, if that directory is different to the shell's current one. That's because the shell is tracking what it knows (where the process started), not the current state.

It's also dependent on the shell.

eg with bash

bash-4.4$ cd /tmp
bash-4.4$ sleep 1000 &
[1] 24807
bash-4.4$ jobs -l
[1]+ 24807 Running                 sleep 1000 &
bash-4.4$ cd /
bash-4.4$ jobs -l
[1]+ 24807 Running                 sleep 1000 &  (wd: /tmp)

But ksh93 doesn't do that

$ sleep 1000 &
[1]     7164
$ jobs -l
[1] + 7164       Running                 sleep 1000 &
$ cd /
$ jobs -l
[1] + 7164       Running                 sleep 1000 &
$ 

I don't believe there's any portable way of finding the cwd of a process. fstat, pwdx and similar may help. You may need root privileges to look at processes you don't own.

On Linux, the processes matching a specific path may be used by looking at the /proc/.../cwd symlink:

eg to find processes with /tmp in the path:

% sudo ls -l /proc/*/cwd | grep /tmp
lrwxrwxrwx. 1 sweh     sweh     0 Jul 28 09:38 /proc/23435/cwd -> /news/tmp
lrwxrwxrwx. 1 sweh     sweh     0 Jul 28 09:39 /proc/7124/cwd -> /news/tmp

Remember this may not match the process's internal representation of the directory because of symlinks:

$ cd /usr/tmp
$ pwd
/usr/tmp
$ ls -l /proc/self/cwd
lrwxrwxrwx. 1 sweh sweh 0 Jul 28 09:41 /proc/self/cwd -> /var/tmp/
$ ls -l /usr/tmp
lrwxrwxrwx 1 root root 10 May 13 09:39 /usr/tmp -> ../var/tmp/
$ 

Here the shell thinks I'm in /usr/tmp but really it's /var/tmp.

EDIT TO ADD:

There is a special case of this problem, where the question might be "what processes are using a mount point". This isn't reporting the cwd but any files that may be open.

So, for example:

$ sudo fuser -u -c /brick
/brick:               3552(root)
$ ps -p 3552
  PID TTY          TIME CMD
 3552 ?        00:04:51 glusterfsd
$

We know the glusterfsd process is the only one using the /brick filesystem

Answer 2

There isn't a portable way to do this with ps but you can use a for loop with ps to print all of the processes and then pipe it to another command to print their current working directories.

Let's start with pwdx which specifically prints the current working directory of a process.

Running as root:

for i in $(ps aux | awk '{print $2}'); do pwdx $i; done

ps aux | awk '{print $2}' prints the pid for each process.

pwdx $i Passes the i variable which is the pid's to pwdx

You can use pwdx on a pid itself but the for loop does them all together.

You can also use lsof but you may need to install the lsof package first depending on your system. Running as root:

for i in $(ps aux | awk '{print $2}'); do lsof -p $i | grep cwd; done

ps aux | awk '{print $2}' prints the PID for each process.

lsof -p $i Passes the i variable to lsof

grep cwd Prints the lines containing cwd or the current working directory.

In regards to the pgrep command, you can use it in the form of:

pgrep <process-name>

in order too find the pid of a process but you'll still have to pass it to either lsof or pwdx to find the current working directory.

The first for loop works with Fedora 28, Centos 7.5, RHEL 7.5, and Debian 9 but not FreeBSD 11.

The second for loop works with Fedora 28, Centos 7.5, RHEL 7.5, and Debian 9. It also works with FreeBSD 11.1 although in my case, it prints out warning messages regarding the lsof version being for FreeBSD 11 while mine is FreeBSD 11.1

Answer 3

The working directories of processes are knowable by other processes in many operating systems. They are queryable from the kernel in the BSDs and on Linux, using sysctl() and procfs respectively. However, neither the Linux ps command from procps nor the ps commands in the BSDs obtain and report this information.

To obtain the current directory of a process on the BSDs, the command is fstat, which reports the filesystem and i-node number.

% fstat -p $$|awk '{ if ("wd" == $4 || 1 == NR) print; }'
USER     CMD          PID   FD MOUNT      INUM MODE         SZ|DV R/W
JdeBP    zsh        71512   wd /usr/home/JdeBP      4 drwxr-xr-x     127  r
% 

Note that, of course, working directories can be reached by multiple names and those names can vary as things are renamed and links are created/destroyed. The stable part of them is the file object, the vnode, not the directory entries for reaching it.

So the Linux mechanism, that reports one name in /proc/pid/cwd, is not necessarily reliable.

Finally: note that the current directory of a process is not necessarily the working directory that it had when the process was spawned, which is all that job control shells actually know.

Further reading

• https://unix.stackexchange.com/a/434437/5132
• https://unix.stackexchange.com/a/413225/5132