Bug 1804334

The following commits have been backported:
v5.8~62 "print_fields.h: add PRINT_FIELD_LEN macro"
v5.8~61 "Move ilog* functions from util.c to defs.h"
v5.8~59 "types: skip field lines that start with comments"
v5.8~54 "tests/inject-nf.test: replace getpid with geteuid"
v5.8~53 "Modify %process class: trace syscalls associated with process lifecycle"
v5.8~18 "fcntl: use print_fields.h macros"
v5.8~17 "kcmp: fix KCMP_FILE decoding"
v5.8~15 "printsiginfo: fix printing of siginfo_t.si_pid and siginfo_t.si_uid"
v5.8~14 "Use PRINT_FIELD_UID instead of printuid where appropriate"
v5.8~10 "Consistently print process ids as signed integers"
v5.8~9 "Remove tcb parameter of read_int_from_file"
v5.8~6 "Add "struct tcb *" parameters to various functions"
v5.8~5 "Introduce SYS_FUNC(tkill)"
v5.8~4 "tests: check decoding of tkill syscall"
v5.8~3 "tests: check decoding of tgkill syscall"
v5.8-5-gdea0284 "PID namespace translation support"
v5.8-6-g173257d "Use printpid in decoders"
v5.8-7-g18c2208 "Use get_proc_pid for /proc paths"
v5.8-8-g7ecee07 "Implement testing framework for pidns"
v5.8-9-gf350ce0 "Add tests for PID namespace translation"

The feature is enabled with "--pidns-translation" option.  Note that PID NS traversal is possible only when NS_GET_PARENT ioctl is available (upstream Linux 4.9+, RHEL 7 ALT and RHEL 8+ kernels; it is not possible for compat processes due to missing [1]).

[1] https://lore.kernel.org/lkml/20200724001248.GC25522@altlinux.org/T/#u

This issue seems to be still reproducible with devtoolset-10-strace-5.7-3.el7:

[root@ibm-p8-kvm-03-guest-12 tmp]# scl enable devtoolset-10 bash
[root@ibm-p8-kvm-03-guest-12 tmp]# strace -f -ff -o s.log unshare --pid -- /bin/sh
sh-4.2# /bin/sh
sh-4.2# /bin/sh
sh-4.2# /bin/sh
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
[root@ibm-p8-kvm-03-guest-12 tmp]# ls
s.log.3092  s.log.3095  s.log.3098  s.log.3101
[root@ibm-p8-kvm-03-guest-12 tmp]# grep clone s.log*
s.log.3092:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x3fffb3863ff0) = 3095
s.log.3095:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x3fffaee93ff0) = 2
s.log.3098:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x3fffae993ff0) = 3
[root@ibm-p8-kvm-03-guest-12 tmp]# rpm -qf $(which strace)
devtoolset-10-strace-5.7-3.el7.ppc64le

The feature is to be explicitly enabled with "--pidns-translation" option, as it incurs significant overhead and clutters the output (since both the original syscall arguments/return values and the translated ones to be displayed).

Thanks Eugene for clarifying that, I overlooked your previous comment explaining the fix. On RHEL-7.9-20200917.0 (kernel 3.10), devtoolset-10-strace-5.7-3.el7 --pidns-translation returns "NS_* ioctl commands are not supported by the kernel":

[root@kvm-02-guest16 tmp]# strace --pidns-translation -f -ff -o s.log unshare --pid -- /bin/sh
sh-4.2# /bin/sh
strace: NS_* ioctl commands are not supported by the kernel
sh-4.2# /bin/sh
sh-4.2# /bin/sh
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
[root@kvm-02-guest16 tmp]# ls s.log.*
s.log.18982  s.log.18985  s.log.18990  s.log.18991
[root@kvm-02-guest16 tmp]# grep clone s.log*
s.log.18982:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f68b74aba10) = 18985
s.log.18985:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fb837c22a10) = 2
s.log.18990:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fc8c25f3a10) = 3
[root@kvm-02-guest16 tmp]# uname -a
Linux kvm-02-guest16.hv2.lab.eng.bos.redhat.com 3.10.0-1160.el7.x86_64 #1 SMP Tue Aug 18 14:50:17 EDT 2020 x86_64 x86_64 x86_64 GNU/Linux

On RHEL-ALT-7.6-updates-20190722.1 (kernel 4.14), devtoolset-10-strace --pidns-translation does work as expected:

[root@ibm-p8-kvm-03-guest-01 tmp]# scl enable devtoolset-10 bash
[root@ibm-p8-kvm-03-guest-01 tmp]# strace --pidns-translation -f -ff -o s.log unshare --pid -- /bin/sh
sh-4.2# /bin/sh
sh-4.2# /bin/sh
sh-4.2# /bin/sh
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
sh-4.2# exit
[root@ibm-p8-kvm-03-guest-01 tmp]# ls s.log.*
s.log.15255  s.log.15260  s.log.15263  s.log.15264
[root@ibm-p8-kvm-03-guest-01 tmp]# grep clone s.log*
s.log.15255:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fffa8d13ff0) = 15260
s.log.15260:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fffb3703ff0) = 2 /* 15263 in strace's PID NS */
s.log.15263:clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fff9db03ff0) = 3 /* 15264 in strace's PID NS */
[root@ibm-p8-kvm-03-guest-01 tmp]# uname -a
Linux ibm-p8-kvm-03-guest-01.virt.pnr.lab.eng.rdu2.redhat.com 4.14.0-115.8.2.el7a.ppc64le #1 SMP Fri Jun 21 07:25:08 EDT 2019 ppc64le ppc64le ppc64le GNU/Linux

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: devtoolset-10-strace), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:5292