KVM_GETPROCS(3) | Library Functions Manual | KVM_GETPROCS(3)

# NAME

`kvm_getprocs`, `kvm_getargv`, `kvm_getenvv` — access user process state

# SYNOPSIS

Kernel Data Access Library (libkvm, -lkvm)
`#include <sys/param.h>`
`#include <sys/sysctl.h>`
`#include <kvm.h>`

struct kinfo_proc *
`kvm_getprocs`(kvm_t *kd, int op, int arg, size_t elemsize, int *cnt);

char **
`kvm_getargv`(kvm_t *kd, const struct kinfo_proc *p, int nchr);

char **
`kvm_getenvv`(kvm_t *kd, const struct kinfo_proc *p, int nchr);

# DESCRIPTION

`kvm_getprocs`() returns a (sub-)set of active processes in the kernel indicated by kd. The op and arg arguments constitute a predicate which limits the set of processes returned. The value of op describes the filtering predicate as follows:

`KERN_PROC_KTHREAD`
  all processes (user-level plus kernel threads)
`KERN_PROC_ALL`
  all user-level processes
`KERN_PROC_PID`
  processes with process ID arg
`KERN_PROC_PGRP`
  processes with process group arg
`KERN_PROC_SESSION`
  processes with session arg
`KERN_PROC_TTY`
  processes with tty(4) arg
`KERN_PROC_UID`
  processes with effective user ID arg
`KERN_PROC_RUID`
  processes with real user ID arg

Only the first elemsize bytes of each array entry are returned. If the size of the kinfo_proc structure increases in size in a future release of OpenBSD, the library will only return the requested amount of data for each array entry and programs that use `kvm_getprocs`() will continue to function without the need for recompilation. The number of processes found is returned in the reference parameter cnt. The processes are returned as a contiguous array of kinfo_proc structures, the definition for which is available in `<sys/sysctl.h>`. This memory is locally allocated, and subsequent calls to `kvm_getprocs`() and `kvm_close`() will overwrite this storage.

`kvm_getprocs`() sets the thread ID field accordingly for each thread except for the process (main thread) which has it set to -1.

`kvm_getargv`() returns a null-terminated argument vector that corresponds to the command line arguments passed to process indicated by p. Most likely, these arguments correspond to the values passed to execve(2) on process creation. This information is, however, deliberately under control of the process itself. Note that the original command name can be found, unaltered, in the p_comm field of the process structure returned by `kvm_getprocs`().

The nchr argument indicates the maximum number of characters, including null bytes, to use in building the strings. If this amount is exceeded, the string causing the overflow is truncated and the partial result is returned. This is handy for programs like ps(1) and w(1) that print only a one line summary of a command and should not copy out large amounts of text only to ignore it. If nchr is zero, no limit is imposed and all argument strings are returned in their entirety.

The memory allocated to the `argv` pointers and string storage is owned by the kvm(3) library. Subsequent `kvm_getprocs`() and kvm_close(3) calls will clobber this storage.

The `kvm_getenvv`() function is similar to `kvm_getargv`() but returns the vector of environment strings. This data is also alterable by the process.

# RETURN VALUES

`kvm_getprocs`(), `kvm_getargv`(), and `kvm_getenvv`() all return `NULL` on failure.

# SEE ALSO

kvm(3), kvm_geterr(3), kvm_nlist(3), kvm_open(3), kvm_read(3)

# BUGS

These routines do not belong in the kvm(3) interface.

June 6, 2025 | Debian