Heya, this PR lays some first groundwork in order to get to tracing parity with strace itself.
I've rewritten the main tracing-loop, to more robustly handle signals and the various other ptrace events (documented in code for now). It's still far from strace's main tracing-loop, but already manages to fix some important bugs.
Both exit and exit_group are now properly handled.
-f, --follow-forks now actually follows forks.
Running a binary that spawns threads won't hang if -f is not supplied.
Some notes of things that aren't yet (properly) implemented:
Signals are passed to the child via ptrace(PTRACE_CONT, ...).
This needs some work (more complex fall-through logic for WIFSTOPPED(status) and various other edge-cases).
exec-family syscalls can't report their arguments.
lurk uses exec from std::os::unix::process to load it's tracee into the forked process. This exec from std::os::unix::process issues various other syscalls (like dup2) before actually execve'ing. This makes it quite hard to properly implement logic to catch the arguments of any exec-family syscall. The usual trick to just kill(getpid(), SIGSTOP) after a ptrace(PTRACE_TRACEME, ...) request to give the parent a chance to catch the execve, won't do it in this case.
seccomp
Additionaly I've also added the missing 27 syscalls from number 424 to 450.
Due to the syscall gap from 334 to 424 the solution's probably a bit iffy, but it works. Refactoring definitely welcome. This fixes #24 and probably a bunch of other binaries which rely on these newer syscalls.
Heya, this PR lays some first groundwork in order to get to tracing parity with
strace
itself. I've rewritten the main tracing-loop, to more robustly handle signals and the various otherptrace
events (documented in code for now). It's still far fromstrace
's main tracing-loop, but already manages to fix some important bugs.exit
andexit_group
are now properly handled.-f, --follow-forks
now actually follows forks.-f
is not supplied.Some notes of things that aren't yet (properly) implemented:
Signals are passed to the child via
ptrace(PTRACE_CONT, ...)
. This needs some work (more complex fall-through logic forWIFSTOPPED(status)
and various other edge-cases).exec
-family syscalls can't report their arguments.lurk
usesexec
fromstd::os::unix::process
to load it's tracee into the forked process. Thisexec
fromstd::os::unix::process
issues various other syscalls (likedup2
) before actuallyexecve
'ing. This makes it quite hard to properly implement logic to catch the arguments of anyexec
-family syscall. The usual trick to justkill(getpid(), SIGSTOP)
after aptrace(PTRACE_TRACEME, ...)
request to give the parent a chance to catch theexecve
, won't do it in this case.seccomp
Additionaly I've also added the missing 27 syscalls from number 424 to 450. Due to the syscall gap from 334 to 424 the solution's probably a bit iffy, but it works. Refactoring definitely welcome. This fixes #24 and probably a bunch of other binaries which rely on these newer syscalls.