Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.
Sign up to join this community
Why are some files under /proc are universally readable by anyone using adb?
e.g.
/proc/<pid>/statm
/proc/<pid>/maps
/proc/<pid>/smaps
We can even cat the content of these files, which is dangerous to leak sys info.
Is it because other system components are also using/reading/writing these files under /proc, so that these files under /proc are universally readable to anyone?
There are perfectly good reasons why those informations are readable, and that's nothing dangerous (writing, however, would be). This is inherited from the Linux system Android builds upon -- and I will give you a few short examples to show you the good of it:
If you list contents of the /proc (virtual) directory, you will find things like e.g.:
/proc/meminfo: This is where all apps can obtain information about total/used/available RAM -- so e.g. system monitors can present these details/proc/devices: Shows all devices available on the system, so e.g. a camera app can tell if (and where) there is a camera to be used -- or exit otherwise/proc/uptime: to show you how long the device is already runningAnd more. Nothing dangerous about knowing this -- just the opposite: to many apps these are essential information so they can do their job.
Now to your special /proc/<pid> sub-tree: Again it is the system monitors (and the task killers) depending on this information. Here they can get a list of running processes. All the details on those apps (how long have they been running, how much memory are they using, etc.) is to be found here. No system monitor could do without this. And again, there's nothing harmful about reading here. The maximum "bad" thing about this is any app could look what other apps are running, and what resources they are using.
From a user's perspective, we won't dig much deeper here. Just one more thing to say: these informations can be very useful if you have to go troubleshooting. Some of my answers even included this already.
And for sure you don't need to be afraid of "dangerous leaks" just from the fact this all is world-readable. Moreover, as Lie Ryan makes clear in his answer, not all of the information here is world-readable: Some sensitive information is, in fact, protected.
Also keep in mind that ADB generally has more privileges than any other "normal user process". Especially starting with Android 4.0 Ice Cream Sandwich (ICS) its privileges have been increased (e.g. to make a complete backup possible even if the device is not rooted), so you cannot take "access via ADB" as a reference here -- but rather should check from a (local) terminal. Additionally, risks are increased when connecting via ADB with USB debugging enabled, as this again increases privileges granted to ADB.
The files
/proc/<pid>/maps
/proc/<pid>/smaps
are NOT universally readable by anyone, at least not in stock device.
Try running from a Terminal Emulator from inside Android (running as a regular user), instead of ADB (which runs at a slightly elevated privilege). ADB runs with a lot of privileges because it's used for debugging and need to be able to access a lot of device features, that's why it's dangerous to connect a device to an untrusted machine with USB debugging enabled.
And the file /proc/<pid>/statm is also readable in desktop linux systems.
