From owner-freebsd-questions@FreeBSD.ORG Mon Dec 22 17:58:03 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 65E5E1065676 for ; Mon, 22 Dec 2008 17:58:03 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from email2.allantgroup.com (email2.emsphone.com [199.67.51.116]) by mx1.freebsd.org (Postfix) with ESMTP id 13AC78FC1E for ; Mon, 22 Dec 2008 17:58:02 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan-a.emsphone.com [199.67.51.107]) by email2.allantgroup.com (8.14.0/8.14.0) with ESMTP id mBMHw2FX052048 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 22 Dec 2008 11:58:02 -0600 (CST) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (smmsp@localhost [127.0.0.1]) by dan.emsphone.com (8.14.3/8.14.3) with ESMTP id mBMHw10u053072 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 22 Dec 2008 11:58:01 -0600 (CST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.3/8.14.3/Submit) id mBMHw1b8053070; Mon, 22 Dec 2008 11:58:01 -0600 (CST) (envelope-from dan) Date: Mon, 22 Dec 2008 11:58:01 -0600 From: Dan Nelson To: Laszlo Nagy Message-ID: <20081222175801.GG90803@dan.emsphone.com> References: <494FA0E0.1060108@shopzeus.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <494FA0E0.1060108@shopzeus.com> X-OS: FreeBSD 7.1-PRERELEASE User-Agent: Mutt/1.5.18 (2008-05-17) X-Virus-Scanned: ClamAV version 0.94.1, clamav-milter version 0.94.1 on email2.allantgroup.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2 (email2.allantgroup.com [199.67.51.78]); Mon, 22 Dec 2008 11:58:02 -0600 (CST) X-Scanned-By: MIMEDefang 2.45 Cc: freebsd-questions@freebsd.org Subject: Re: "truss" is buggy? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Dec 2008 17:58:03 -0000 In the last episode (Dec 22), Laszlo Nagy said: > Apparently, the "truss" trace tool has a bug. At least I was told > that the tracer program should not change the return value of the > getppid() call inside the traced process. Here is an example program: It looks like the ptrace() syscall is the problem: DESCRIPTION The ptrace() system call provides tracing and debugging facilities. It allows one process (the tracing process) to control another (the traced process). The tracing process must first attach to the traced process, and then issue a series of ptrace() system calls to control the execution of the process, as well as access process memory and register state. For the duration of the tracing session, the traced process will be ``re-parented'', with its parent process ID (and resulting behavior) changed to the tracing process. I imagine that also explains why a truss'ed program will die if you kill -9 the truss process. It looks like the "reset parent when trussing" behaviour appeared back in 1996 (sys_process.s r1.21). The fix would probably be to store the pid of the tracing process somewhere other than p_ppid... -- Dan Nelson dnelson@allantgroup.com