In regard to getting rawlog entries with passwd but not with LDAP:
On Wed, Aug 20, 2003 at 11:34:05PM +0300, Timo Sirainen wrote:
I'm clueless on this. What does /proc/pid/pwd symlink do? Can you give an example from the command line?
It would just show current directory of the process. Like:
lrwxrwxrwx 1 cras cras 0 2003-08-20 23:25 cwd -> /home/cras
In FBSD, you get the files associated with a process with fstat -p <pid> For an imap process opened under LDAP authentication, the output is USER CMD PID FD MOUNT INUM MODE SZ|DV R/W postkont imap 5876 root / 2 drwxr-xr-x 1024 r postkont imap 5876 wd / 7961 drwx------ 512 r postkont imap 5876 text /usr 2301620 -r-xr-xr-x 326420 r postkont imap 5876 0* internet stream tcp c5f1efc0 postkont imap 5876 1* internet stream tcp c5f1efc0 postkont imap 5876 2 / 7957 crw-rw-rw- null r postkont imap 5876 3* local dgram c644bd20 <-> c6357f00
The working directory is marked by "wd" in the "FD" column. In this case, it's /. According to the man page, a "text" directory is an "executable text inode". I don't know what that means; I'm just quoting.
If I switch to passwd authentication, then I get two imap processes: 5826 ?? S 0:00.01 imap [bob 127.0.0.1] 5827 ?? I 0:00.00 imap: imap [bob:5826 rawlog] (imap)
fstat for the first is USER CMD PID FD MOUNT INUM MODE SZ|DV R/W bob imap 5826 root / 2 drwxr-xr-x 1024 r bob imap 5826 wd /usr 3960238 drwxr-xr-x 2560 r bob imap 5826 text /usr 2301620 -r-xr-xr-x 326420 r bob imap 5826 2 / 7957 crw-rw-rw- null r bob imap 5826 3* local dgram c6357640 <-> c6357f00 bob imap 5826 7* local stream c6357500 <-> c644bc80
The working directory is now /usr, and there's a local stream that wasn't present with LDAP.
fstat for the rawlog imap process is USER CMD PID FD MOUNT INUM MODE SZ|DV R/W bob imap 5827 root / 2 drwxr-xr-x 1024 r bob imap 5827 wd /usr 3960238 drwxr-xr-x 2560 r bob imap 5827 text /usr 2301620 -r-xr-xr-x 326420 r bob imap 5827 0* internet stream tcp c5ea06c0 bob imap 5827 1* internet stream tcp c5ea06c0 bob imap 5827 2 / 7957 crw-rw-rw- null r bob imap 5827 3* local dgram c6357640 <-> c6357f00 bob imap 5827 4 /usr 3976421 -rw------- 0 w bob imap 5827 5 /usr 3976422 -rw------- 0 w bob imap 5827 6* local stream c644bc80 <-> c6357500
This is probably way more info that you need, but little of this means anything to me, so I don't know what is significant and what isn't.
Bob Hall