Say I'm running a server application on
127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run
lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<ClientPort>
which outputs something like
p6429 f4 p6433 f5
p* are the PIDs of both participants/endpoints.
Now my question is: can I trust
lsof's output (provided that nobody modified the
lsof-binary)? Or in other terms: Could someone without root-permissions manipulate
lsofs output to display a different PID?
Edit: If this is platform-dependent, I'm specifically interested in macOS, Linux and FreeBSD.