I am trying to understand process exe on my Ubuntu server
sudo ls -l /proc/6293/exe
lrwxrwxrwx 1 jenkins 65533 0 апр 4 09:03 /proc/6293/exe -> /usr/local/bin/node
When I look for in bin
/usr/local/bin# ls node
ls: cannot access 'node': No such file or directory
what does this symbolic link really points to?
Executable programs of a process may be in a container or other fancy chroot, or the file may have been unlinked while it was still running.
On Linux, most container (docker, podman) or service manager (systemd) things use cgroups. Also visible on proc, have a look at
/proc/$pid/cgroup
Mapping these to unknown container tech isn't always obvious. Although sometimes it is, podman puts "libpod" in the path and a big long ID that can be passed topodman inspect
.User "jenkins" implies the Jenkins CI/CD software. Executable name "node" implies something written in Node.js. Would not be surprising here to see a software build process that sets up a complete environment installing everything. Then deleting it and starting clean on the next build.
The job messing around with
/usr/local/bin/node
seems to me to be unlikely. Versus just assuming that Jenkins nodes have nodejs installed. That's a system path, usually you would not want to be running a build process privileged. But this is arbitrary code so I have no idea what this thing is let alone how messy it is.Ultimately, someone should be responsible for what this software is. Keeping it working for your organization, in addition to secure. If this is not you and you are just providing the server, still would be good to have some curiosity about what's running and ask some basic questions. Is this thing using nodejs? How is Jenkins used to make it happen? Is the running of tasks implemented with containers?