Attachment 158292 Details for Bug 246330 – Shows ptrace loosing track of a forked process

Shows ptrace loosing track of a forked process

ptracefork.c (text/plain), 3.31 KB, created by John D. Ramsdell on 2007-06-30 13:41:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: John D. Ramsdell

Created: 2007-06-30 13:41:56 UTC

Size: 3.31 KB

patch

obsolete

>/* This program demonstrates a change in the behavior of ptrace.  It
>   appears that ptrace doesn't follow forks as it used to.  On older
>   Linux systems, this program prints "Process P forked Q" when
>   process P forked process Q but before Q runs.  On machines running
>   the 2.6.21 kernel, the program misses some of the forks.
>
>   John D. Ramsdell -- The MITRE corporation -- June 2007 */
>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <errno.h>
>#include <stddef.h>
>#include <unistd.h>
>#include <signal.h>
>#include <sys/types.h>
>#include <sys/wait.h>
>#include <sys/ptrace.h>
>#include <linux/ptrace.h>
>
>/* If the system headers do not provide the constants, hard-code the
>   normal values.  */
>#ifndef PTRACE_EVENT_FORK
>
>#define PTRACE_GETEVENTMSG	0x4201
>
>/* options set using PTRACE_SETOPTIONS */
>#define PTRACE_O_TRACESYSGOOD	0x00000001
>#define PTRACE_O_TRACEFORK	0x00000002
>#define PTRACE_O_TRACEVFORK	0x00000004
>#define PTRACE_O_TRACECLONE	0x00000008
>#define PTRACE_O_TRACEEXEC	0x00000010
>#define PTRACE_O_TRACEVFORKDONE	0x00000020
>#define PTRACE_O_TRACEEXIT	0x00000040
>
>/* Wait extended result codes for the above trace options.  */
>#define PTRACE_EVENT_FORK	1
>#define PTRACE_EVENT_VFORK	2
>#define PTRACE_EVENT_CLONE	3
>#define PTRACE_EVENT_EXEC	4
>#define PTRACE_EVENT_VFORK_DONE	5
>#define PTRACE_EVENT_EXIT	6
>
>#endif /* PTRACE_EVENT_FORK */
>
>#define SCRIPT "echo boo | /usr/bin/wc"
>
>int main(int argc, char **argv)
>{
>  pid_t pid = fork();
>  switch (pid) {
>
>  case -1:			/* Error */
>    perror("Fork failed");
>    return 1;
>
>  case 0:			/* Child */
>    if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) < 0) {
>      perror("ptrace(PTRACE_TRACEME, ...)");
>      return 1;
>    }
>    execl("/bin/sh", "/bin/sh", "-c", SCRIPT, NULL);
>    perror("exec");
>    return 1;
>
>  default:			/* Parent */
>    fprintf(stderr, "Child is %d\n", pid);
>    for (;;) {
>      int status;
>      do {			/* Wait but ignore interrupted */
>	pid = wait(&status);	/* system calls */
>      }
>      while (pid < 0 && errno == EINTR);
>      if (pid < 0) {
>	if (errno == ECHILD)	/* No children to wait for */
>	  return 0;		/* Declare success */
>	perror("wait");
>	return 1;
>      }
>      fprintf(stderr, "\nWait status for %d is %d (0x%x)\n",
>	      pid, status, status);
>      if (WIFSTOPPED(status)) {
>	int signal = WSTOPSIG(status);
>	fprintf(stderr, "Process %d stopped with signal = %d\n",
>		pid, signal);
>	if (signal == SIGTRAP) { /* Tracing caused this signal */
>	  signal = SIGSTOP;
>	  unsigned long msg;
>	  if (ptrace(PTRACE_GETEVENTMSG, pid, NULL, &msg) < 0) {
>	    perror("ptrace(PTRACE_GETEVENTMSG, ...)");
>	    return 1;
>	  }
>	  pid_t child = (pid_t)msg;
>	  if (child)
>	    /* This is the place at which one can perform an
>	       interesting action on the child before it runs, such as
>	       add an audit rule that causes it to be traced. */
>	    fprintf(stderr, "Process %d forked %d\n", pid, child);
>	  else {		/* This is where the original child */
>	    fprintf(stderr, 	/* gets its options set. */
>		    "Set options on %d due to SIGTRAP without a child\n",
>		    pid);
>	    int options = PTRACE_O_TRACEFORK;
>	    if (ptrace(PTRACE_SETOPTIONS, pid, NULL, options) < 0) {
>	      perror("ptrace(PTRACE_SETOPTIONS, ...)");
>	      return 1;
>	    }
>	  }
>	}
>	if (ptrace(PTRACE_CONT, pid, NULL, signal) < 0) {
>	  perror("ptrace(PTRACE_CONT, ...)");
>	  return 1;
>	}
>      }
>    }
>  }
>}

Actions: View

Attachments on bug 246330: 158292