Say I'm running a server application on and a local process (possibly owned by a different user) connects to it, I can run

lsof -Fp -i TCP@ -i TCP@<ClientPort>

which outputs something like


where p* are the PIDs of both participants/endpoints.

Now my question is: can I trust lsof's output (provided that nobody modified the lsof-binary)? Or in other terms: Could someone without root-permissions manipulate lsofs output to display a different PID?

Edit: If this is platform-dependent, I'm specifically interested in macOS, Linux and FreeBSD.

  • 1
    Oh, this is a misunderstanding – I'm only listening on and interested in connections on the same machine (loopback/localhost)... – K. Biermann Oct 25 '18 at 12:58
  • 2
    Aha! So you're asking if there are any tricks involving files / symlinks / hardlinks / named pipes / etc that would cause lsof to report incorrectly? Interesting question indeed! +1 – Mike Ounsworth Oct 25 '18 at 13:02
  • 1
    Is that edit still in keeping with what you're trying to ask? – Mike Ounsworth Oct 25 '18 at 13:05
  • Yes, this is fine; ty 😊 – K. Biermann Oct 25 '18 at 13:10
  • My gut says probably not on Linux, unless they can manipulate LSM's or load kernel modules (neither of which actually require root access on Linux, you just have to have the right capabilities). – Austin Hemmelgarn Oct 25 '18 at 19:11

If you trust the user running lsof and specify the full path (/usr/bin/lsof?), you should be able to trust the output. If you're aiming for lsof to run as the user who is connecting to your server, it's really difficult to prevent an lsof in their path from running or an alias catching the call first. Also see 'netstat -A inet -A inet6 -alp'

If you're really paranoid you could check the package manager database (rpm, dpkg, etc) to make sure that the binary hadn't changed since install before calling it (with the full path).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.