Investigative /proc entries

/proc/PID directories lets you see what's up with processes: 

cmdline - the command line arguments the program was launched with
cwd - a symlink to the current working directory
environ - a NULL separated list of environment variables
exe - a symlink to the executable
fd/# - symlinks to the files open by the process
stat/statm/status - various stats in mostly machine readable form.

 # perl -lpe 's/\0/\n/g' environ | head
 DISPLAY=:0.0
 
 # grep Uid status
 Uid:   1000     1000      0      1000        # uid   euid   suid   fsuid
 
 # ls -l fd/[35]
 lrwx------    1 bad  guy    64 Apr 24 21:02 3 -> /tmp/foo
 l-wx------    1 bad  guy    64 Apr 24 21:02 5 -> /tmp/tmpfg3RD3J (deleted)