Styjun

The intention of below SystemTap script is to start straceing whenever a process with a given filename is started.

It is called with the following command:

stap -g -v './sstrace.stp' "$PATTERN"

Where PATTERN can for example be mount.

#!/usr/bin/env stap

# Assign command line parameter to the variable.
@define target_filename %( @1 %) # The regex the script will trigger on given as CLI parameter

probe begin 
 printf( "Probe starting ...n" )
 printf( "Try to attach strace upon executing binary (regex) /%s/nn" , @target_filename )


probe end 
 printf( "Wrapping up ...n" )


probe syscall.execve 
 if ( filename =~ @target_filename ) 
 start_trace( pid() )
 


###
### FUNCTIONS
###

function start_trace( pid ) 
 raise( 19 )
 # Sleeping is bad practice in SystemTap probe, but don't know how to otherwise
 # wait for strace to initialize in time. This will not work as expected when
 # workting interactively. Compare these two results while increasing below sleep
 # to 1 second.
 # $ sudo ./go date
 # $ date; echo hi
 # $ bash -c 'date; echo hi'
 system( sprintf( "strace -f -p %i & sleep 0.01; kill -CONT %i" , pid , pid ) )

The idea is that I stop execution (raise( -19 )) of the target process long enough for strace to attach to the process and, then restarting the target process (kill -CONT $TARGET_PID). This often works, but unfortunately intermittent.

When it works, strace kicks in right after execve(), similar to this:

$ strace date 2>&1 | head
execve("/bin/date", ["date"], 0x7ffeb7ce6430 /* 64 vars */) = 0 
brk(NULL) = 0x5578de8fa000 <== strace kicks in here.
access("/etc/ld.so.nohwcap", F_O............

Now the problem I really at least want to understand and hopefully solve, is the fact that on some systems I cannot kill -STOP the target process, it simply throws an error along the lines of: kill: process xyz does not. exist.

I know by the time the execve syscall is called, the PID already exists. What I don't understand is why it doesn't seem to obey the SIGSTOP.

Does anyone know why this happens, how to fix the SystemTap script or have an even smarter way to accomplish the goal starting to trace a process on the fly?