Correct a bug where pr_data should have been assigned.

MFp4: Bugfixes for truss(1):

- Fix logic handling execve(). We will not be able to
obtain information otherwise.
- truss coredump [1].
- truss does not work against itself [2].

PR: bin/5897

MFp4: Bugfixes for truss(1):

- Fix logic handling execve(). We will not be able to
obtain information otherwise.
- truss coredump [1].
- truss does not work against itself [2].

PR: bin/58970 [1], bin/45193 [2]
Submitted by: Howard Su
Approved by: re (kensmith)

show more ...

Make use of ptrace(2) instead of procfs in truss(1), eliminating
yet another need of an available /proc/ mount.

Tested with: make universe
Submitted by: howardsu
Reviewed by: alfred

- Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
pathconf, truncate, ftruncate, kill

-

- Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
pathconf, truncate, ftruncate, kill

- Decode more arguments of open, mprot, *stat, and fcntl.

- Convert all constant-macro and bitfield decoding to lookup tables; much
cleaner than previous code.

- Print the timestamp of process exit and signal reception when -d or -D are in
use

- Try six times with 1/2 second delay to debug the child

PR: bin/52190 (updated)
Submitted by: Dan Nelson <dnelson@allantgroup.com>
Approved by: alfred

show more ...

When doing the initial open of the proc via procfs, complain if we are
unable to open the /proc/pid/mem file. Otherwise doing a truss on
a nonexistant pid makes us return success even though no such

When doing the initial open of the proc via procfs, complain if we are
unable to open the /proc/pid/mem file. Otherwise doing a truss on
a nonexistant pid makes us return success even though no such process
exists.

show more ...

I've been working on this somewhat so I'm moving the
parts I'm touching to be as style(9) compliant as I can.

Move declarations of Procfd to a header file.

Add FBSDID. Do not \n terminate warnx() argument. fprint() -> warnx().

- Use time.h not sys/time.h.
- Fix printf format errors.

Submitted by: bde

Include <sys/time.h> for the declaration of struct timeval. Do not
depend on namespace pollution in <signal.h>. (truss shouldn't be
using timevals anyway, since it was implemented long after timeva

Include <sys/time.h> for the declaration of struct timeval. Do not
depend on namespace pollution in <signal.h>. (truss shouldn't be
using timevals anyway, since it was implemented long after timevals
were obsoleted by timespecs.)

show more ...

Allow tracking fork()ed children.

PR: bin/25587 (in part)
MFC after: 3 weeks

Parameterize globals.

PR: bin/25587 (in part)
MFC after: 3 weeks

Partial WARNS=1 fizes with NO_WERROR set to prevent world breakage.
Use __FBSDID().

Back out part of previous commit: remove #include <sys/proc.h>.

#include <sys/proc.h> where needed (for the stop event definitions) and
reorder includes everywhere to conform to style(9).

Handle the case where we truss an SUGID program -- in particular, we need
to wake up any processes waiting via PIOCWAIT on process exit, and truss
needs to be more aware that a process may actually d

Handle the case where we truss an SUGID program -- in particular, we need
to wake up any processes waiting via PIOCWAIT on process exit, and truss
needs to be more aware that a process may actually disappear while it's
waiting.

Reviewed by: Paul Saab <ps@yahoo-inc.com>

show more ...

$Id$ -> $FreeBSD$

Calls one or more of malloc(), warn(), err(), syslog(), execlp() or
execvp() in the child branch of a vfork(). Changed to use fork()
instead.

Some of these (mv, find, apply, xargs) might benefit gre

Calls one or more of malloc(), warn(), err(), syslog(), execlp() or
execvp() in the child branch of a vfork(). Changed to use fork()
instead.

Some of these (mv, find, apply, xargs) might benefit greatly from
being rewritten to use vfork() properly.

PR: Loosely related to bin/8252
Approved by: jkh and bde

show more ...

Sort Xrefs. Use err(3). Remove uneeded #include.
Correct usage: one of {-p pid, command} is required.
Open output file when command line is fully analyzed: incorrect `truss -o f'
command does not cre

Sort Xrefs. Use err(3). Remove uneeded #include.
Correct usage: one of {-p pid, command} is required.
Open output file when command line is fully analyzed: incorrect `truss -o f'
command does not create an empty file anymore.

show more ...

Add some copyright and license terms, at Jordan's request. Note that
syscall.h just refers to another file for the copyright notice.

Change the ioctls for procfs around a bit; in particular, whever possible,
change from

ioctl(fd, PIOC<foo>, &i);

to

ioctl(fd, PIOC<foo>, i);

This is going from the _IOW to _IO ioctl macro. The

Change the ioctls for procfs around a bit; in particular, whever possible,
change from

ioctl(fd, PIOC<foo>, &i);

to

ioctl(fd, PIOC<foo>, i);

This is going from the _IOW to _IO ioctl macro. The kernel, procctl, and
truss must be in synch for it all to work (not doing so will get errors about
inappropriate ioctl's, fortunately). Hopefully I didn't forget anything :).

show more ...

Use the new PF_LINGER flag -- when this is set in a process' proc structure,
said process will not have its event mask cleared (and be restarted) on
the last close of a procfs/mem file for that pid.

Use the new PF_LINGER flag -- when this is set in a process' proc structure,
said process will not have its event mask cleared (and be restarted) on
the last close of a procfs/mem file for that pid. This reduces the chance
that a truss-monitored process will be left hanging with these bits set
and nobody looking for it.

This is the least-tested change of all of these, I'm afraid.

show more ...

err(3) already includes strerror(errno) and a trailing \n

Set the close-on-exec flag in the child; otherwise, it eats up a
file descriptor that it shouldn't.

Truss program. Requires procfs.