Is there an equivalent of what the -T
and -U
option of the truss
Solaris utility does on Linux.
Those are to specify a system call (-T
) or library function (-U
) which when called by the traced application would cause it to stop.
Or, said otherwise, I'd want any process started by a traced application to be stopped (as if killed by SIGSTOP) as soon as it makes a given system call or a given shared library function call.
strace
and ltrace
on Linux provide with much of the featureset of Solaris truss
, but they don't seem to be doing that.
For instance:
truss -f -T open cmd
Would be like strace -f cmd
except that if the process executing cmd
or any of its descendants does any open
system call, it would be stopped immediately (and I can resume it later on at my convenience)
In some cases, I could use gdb
's catch syscall
, but I was looking for a solution that can conveniently follow forks and continue doing it for all the forked processes and keep on doing it even after execve
s.
I seem to recall some utility giving the same functionality, even one (or options to that same utility) to single-step applications between some occurrences of some syscall remotely like that, but my memory is failing me, I can't even be sure that was on Linux.
Best Answer
To the best of my knowledge this can't be done with
strace
, theptrace
function which is used internally doesSIGSTOP
orSIGINT
on calls.EDIT:
I inserted this simple solution in ministrace, so no coding is required.
My proposed solution, if the not all the functionality of strace is required, would be to modify ministrace - which I found here Write yourself an strace in 70 lines of code.
In a one shot program you could add two lines before the following code:
Pseudo code:
I've not tesed any of this, these final steps are left to you.