Bug 97163

Summary: (PTRACE)strace -f broken on i386
Product: [Retired] Red Hat Linux Reporter: P Fudd <ofudd>
Component: kernelAssignee: Arjan van de Ven <arjanv>
Status: CLOSED DUPLICATE QA Contact: Brian Brock <bbrock>
Severity: high Docs Contact:
Priority: medium    
Version: 9CC: roland
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2006-02-21 18:56:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description P Fudd 2003-06-11 02:59:26 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20030225

Description of problem:
strace -fo/tmp/a -p <pid>

When run against a currently running process, the process gets put into 'T'
state according to ps, but strace bombs out with an error.  

Version-Release number of selected component (if applicable):
strace-4.4.97-1

How reproducible:
Always

Steps to Reproduce:
1.start a program.  I use httpd as an example.
2.strace -fo/tmp/a -p <pid>, where <pid> is one of the httpd child processes.
3.Get an error message, and the process is now listed as 'T' in ps, and it
becomes unkillable half the time.  Unkillable as in 'killall -9 httpd' doesn't
kill it, a reboot is necessary.  If the httpd process was serving port 80, port
80 becomes unusable until that process is gone.
    

Actual Results:  # strace -fo/tmp/a -p 1085
trace: ptrace(PTRACE_SYSCALL, ...): Operation not permitted
detach: ptrace(PTRACE_DETACH, ...): Operation not permitted
#

Expected Results:  Strace should have run.

Additional info:

This is happening on rh8 and rh9, and even with the latest rawhide rpm of
strace: strace-4.4.97-1, I believe.  Kernel 2.4.18-27.8.0.

Comment 1 P Fudd 2003-06-12 01:44:17 UTC
By "I believe", I mean "I believe it to be the latest version on rawhide", not
"I believe I know what version of strace I'm running."

Comment 2 Roland McGrath 2003-06-26 22:47:34 UTC
This is a kernel issue.  I have reproduced it under kernel-smp-2.4.20-9
on i686, which is the kernel this report ought to refer to if its Version
field is 9.

Comment 3 Joe Orton 2003-07-08 16:55:52 UTC

*** This bug has been marked as a duplicate of 89057 ***

Comment 4 Red Hat Bugzilla 2006-02-21 18:56:39 UTC
Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.