I dug through the lsof code as suggested, and found the answer.
Essentially the lsof utility opens files in /proc/XX/fdinfo/YY
where XX
is the process PID and YY
is the file descriptor number. Each of those files is a tiny text file that looks like this:
user@host:/proc/6095/fdinfo$ cat 8 pos: 0 flags: 02004002
Consulting additional manpages, the "flags" field refers to flags passed to the open system command relevant man page for open(2) here. So just to make it a bit more difficult, of course open()
defines all of those flags symbolically, not numerically. So what do flags of 02004002
(example above) mean?
I found definitions as part of libc6-dev, in /usr/include/i386-linux-gnu/bits/fcntl-linux.h
, including these excerpted: (warning do not trust these values for your system, look them up yourself as they may be different)
# define O_CREAT 0100 # define O_APPEND 02000 #define O_ACCMODE 0003 #define O_RDONLY 00 #define O_WRONLY 01 #define O_RDWR 02 # define O_CREAT 0100 /* Not fcntl. */ # define O_TRUNC 01000 # define __O_DIRECTORY 0200000 # define O_DIRECTORY __O_DIRECTORY /* Must be a directory. */ # define O_NONBLOCK 04000 # define __O_CLOEXEC 02000000
So given flags: 02004002, that file looks like it's open for read/write (02), non-blocking (4000), close-on-exec (2000000).
HTH someone else who gets confused on these points.