Didn't check the code, but lsof seems a good approach. How does that work with the various namespaces? From root namespace you should see everything. But in a

Didn't check the code, but lsof seems a good approach. How does that work with the various namespaces? From root namespace you should see everything. But in a mount namespace you could bind mount under a different name. How would that confuse things? With a SELinux module even root cannot do everything. If /proc is mounted privately does it change anything? Not sure, just starting to think. Linux has become incredibly complex since the old days... Edit: orc routinely loads executable sections not belonging to any package.