I need to set sysctl security.bsd.unprivileged_proc_debug=1
for a non root user to make any real use of the procstat
command,
That is correct, and working as intended. If you set this to zero, the non-privileged processes can not debug other processes, and that includes not being able to look at their settings such as open files. In general, this is considered a good thing for security, as in most cases non-privileged users do not need to debug other processes.
What's the proper way to get a full process id path on FreeBSD? surely there must be a way that doesn't involve hacking the planet.
To begin with, please explain clearly what you mean by "full process id path". I think you mean the current working directory of a process. But some of the discussions above are about the currently running binary (executable), so I'll try to answer both.
Strange. For me, it works perfectly, on 11.3-RELEASE. I can to procstat -b and procstat -f from either a user process or from root, and I do see the full path name for either the executing binary (if it exists, as memreflect points out kernel processes do not have one), and I do see the full current working directory in the -f output for all processes (which is always "/" for kernel processes). Example:
Code:
# procstat -f 40614 | fgrep cwd
40614 bash cwd v d r------- - - - /home/ralph
# procstat -b 40614
PID COMM OSREL PATH
40614 bash 1103000 /usr/local/bin/bash
This is suckless terminal st, kinda need that functionality for a few patches but i guess it needs particular code that advertises it's process id cwd for FreeBSD.
I don't understand. What is "suckless terminal st"? And what does it mean for something to advertise its cwd? The current working directory can be examined using procstat, if enabled. If you have control of the source code for a program, why don't you have the program determine its current working directory itself, and then leave it in a well-known place (such as its stdout), for others to inspect?
I think what we have here is actually an XY problem. You are asking how to perform a particular task, namely look up the current working directory or the current running binary of a process. It would probably help us give you more reasoned answers if you explained to us what problem you are actually trying to solve.