From mboxrd@z Thu Jan 1 00:00:00 1970 From: James Antill Subject: Re: An autrace that follows forks Date: Wed, 11 Oct 2006 16:55:30 -0400 Message-ID: <1160600130.10063.34.camel@code.and.org> References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1218806775==" Return-path: Received: from mail.and.org (vpn-248-13.boston.redhat.com [10.13.248.13]) by pobox.corp.redhat.com (8.13.1/8.12.8) with ESMTP id k9BKtZKl016822 for ; Wed, 11 Oct 2006 16:55:35 -0400 In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "John D. Ramsdell" Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1218806775== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-EszUST14iGK86DqmT9Hp" --=-EszUST14iGK86DqmT9Hp Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2006-10-11 at 16:06 -0400, John D. Ramsdell wrote: > Last summer, someone else in my company made a simple version of a > fork following tracer based on the audit library; however it does not > compile on my FC5 machine. The reason is he was including the > kernel's headers for ptrace, which defines PTRACE_O_TRACEFORK and > other symbols not part of the standard ptrace header. I don't like > the idea of requiring kernel headers to compile the extended version > autrace. Note that although the FC5 kernel-headers package might well not be updated, it's very likely that FC5 already has a kernel that supports the PTRACE_O_ options[1]. So, personally, I'd just have something like: #ifndef PTRACE_O_TRACEFORK # define PTRACE_O_TRACEFORK 0x00000002 /* from kernel-2.6.x */ #endif ...and assuming you handle the error return from PTRACE_SETOPTIONS, it should mostly just work on all relevant systems. [1] git-annotate says that flag was added on: 2005-04-16 15:20:36 --=20 James Antill - setsockopt(fd, IPPROTO_TCP, TCP_CONGESTION, ...); setsockopt(fd, IPPROTO_TCP, TCP_DEFER_ACCEPT, ...); setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, ...); --=-EszUST14iGK86DqmT9Hp Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQBFLVpC11eXTEMrxtQRAj+5AKCfEFbjm8ms2XX0yXYBsMyfDuMUQQCdEo7v XIGiGYZD127jYVHLM17ROd0= =j7x9 -----END PGP SIGNATURE----- --=-EszUST14iGK86DqmT9Hp-- --===============1218806775== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1218806775==--