Permissions

witr inspects system directories and process metadata that the operating system protects. Missing fields usually mean a permission boundary, not a bug.

Exit code 3 means witr could not read what it needed. That is deliberately distinct from code 2, which means the process genuinely is not there — see Exit Codes.

Linux and FreeBSD#

If output looks thinner than you expected, run with elevated privileges:

sudo witr [your arguments]

This is most visible when inspecting processes owned by another user: the ancestry chain still resolves, but working directory, open files and environment variables may not.

macOS#

System Integrity Protection restricts access to environment variables of processes you do not own. --env will return partial results on those, and no amount of sudo changes it — the restriction is enforced below the permission model.

Process selection, ports, containers and the ancestry chain are unaffected.

Windows#

Protected processes are inaccessible to any user-mode tool, so environment variables are unavailable for them. Open handles report a count rather than a list.

File lock enumeration is not available on Windows at all — see the feature matrix.

A note on best-effort output#

witr states uncertainty rather than filling gaps with guesses. A field that is missing because of permissions is different from a field that is missing because the information does not exist, and the output distinguishes them.