[root@server120 init]# nc -vv -l -p 2345 &
[root@server120 init]# ps axu | grep 3533 | grep -v grep
root 3533 0.0 0.0 103020 792 pts/1 S 13:46 0:00 nc -vv -l -p 2345
[root@server120 tmp]# netstat -antlp | grep 2345
tcp 0 0 0.0.0.0:2345 0.0.0.0:* LISTEN 3533/nc 
[root@server120 tmp]# lsof -i:2345
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nc 3533 root 3u IPv4 1753126 0t0 TCP *:dbm (LISTEN)

创建文件夹

[root@server120 tmp]# mkdir /tmp/empty
[root@server120 tmp]# mount --bind /tmp/empty/ /proc/3533
mount: block device /tmp/empty is write-protected, mounting read-only
mount: cannot mount block device /tmp/empty read-only

挂不上,一想是因为前几天测试sudo提权的时候把selinux打开了

[root@server120 tmp]# getenforce 
Enforcing
[root@server120 tmp]# setenforce 0
[root@server120 tmp]# mount --bind /tmp/empty/ /proc/3533

然后再看一下,ps和netstat看不到了。

[root@server120 tmp]# ps axu | grep 3533 | grep -v grep
[root@server120 tmp]# netstat -antlp | grep 2345
tcp 0 0 0.0.0.0:2345 0.0.0.0:* LISTEN - 
[root@server120 tmp]# lsof -i:2345
[root@server120 tmp]#

大小变成了4096

[root@server120 tmp]# ls -ld /proc/3533
drwxr-xr-x. 2 root root 4096 7月 21 14:02 /proc/3533

修复:

[root@server120 tmp]# umount /proc/3533

检查mount:
1)/proc/mounts

[root@server120 tmp]# cat /proc/mounts | grep 3533
/dev/mapper/vg_template1-lv_root /proc/3533 ext4 rw,seclabel,relatime,barrier=1,data=ordered 0 0

2)/proc/$$/mountinfo

[root@server120 tmp]# cat /proc/$$/mountinfo | grep 3533
29 16 253:0 /tmp/empty /proc/3533 rw,relatime - ext4 /dev/mapper/vg_template1-lv_root rw,seclabel,barrier=1,data=ordered

3)mount -l

[root@server120 tmp]# mount -l | grep 3533
/tmp/empty on /proc/3533 type none (rw,bind)

因为mount -l 读取的是/etc/mtab,可以直接删除该条目。所以使用1)和2)更靠谱。

参考文章:
http://www.freebuf.com/articles/network/140535.html