pspy is a command line tool for monitoring Linux processes without requiring root permissions.
The tool solves the problem of discovering hidden process execution on Linux systems by combining two monitoring techniques. It performs regular scans of the procfs filesystem to enumerate running processes, and it places inotify watchers on selected filesystem directories to trigger additional scans when file system activity occurs. This dual approach allows it to catch short-lived processes that might otherwise be missed by periodic scanning alone. The tool can reveal commands executed by other users, scheduled cron jobs, and other system activity as it happens in real time.
pspy is well suited for security professionals conducting Linux system enumeration during penetration tests and capture-the-flag competitions. It serves as a practical demonstration of why passing sensitive information as command line arguments is insecure, since the tool can observe such arguments without elevated privileges. The tool offers multiple binary distributions to accommodate different deployment scenarios: statically compiled versions for maximum portability and smaller compressed versions for constrained environments. Configuration options allow users to customize which directories are monitored recursively, which directories are watched without recursion, the interval between procfs scans, and whether to display filesystem events and colored output.
The project maintains a straightforward build process supporting both direct Go compilation and Docker-based builds. The tool includes a working example demonstrating its capability to observe privileged cron jobs, which can be run locally with Docker. Documentation covers the available command line flags and their effects, with sensible defaults that work for most use cases.
