From mboxrd@z Thu Jan  1 00:00:00 1970
From: ramsdell@mitre.org (John D. Ramsdell)
Subject: Re: An autrace that follows forks
Date: 13 Oct 2006 09:50:30 -0400
Message-ID: <ogtlknk2ul5.fsf@divan.mitre.org>
References: <ogtbqoiwraf.fsf@divan.mitre.org>
	<1160600130.10063.34.camel@code.and.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <1160600130.10063.34.camel@code.and.org>
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: James Antill <james.antill@redhat.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

I realize others on this list aren't interested in a version of
autrace that follows forks using ptrace, but I thought I'd share
tricks I learned for following forks.  Once the traced child is
started, the parent goes into a loop waiting for signals.  The tricky
part seems to be that the SIGTRAP generated by the parent's immediate
child has to be converted to a SIGSTOP before continuing the child.

static int			/* Watch all children */
watch(pid_t pid)		/* This process' child is pid  */
{				/* Function returns an exit code */
  if (add_rule(pid))
    return 1;
  for (;;) {
    int status;
    pid = wait_for_it(&status);
    if (pid < 0) {
      if (errno == ECHILD)	/* No children to wait for */
	return 0;		/* Declare success */
      perror("wait");
      return 1;
    }
    if (WIFSTOPPED(status)) {
      int signal = WSTOPSIG(status);
      if (signal == SIGTRAP) {	/* Tracing causes this signal */
	unsigned long msg;
	if (geteventmsg(pid, &msg) < 0) {
	  perror("ptrace(PTRACE_GETEVENTMSG, ...)");
	  return 1;
	}
	pid_t child = (pid_t)msg;
	if (child) {
	  /* The child of each traced fork is noted here */
	  if (add_rule(child))
	    return 1;
	}
	/* Only this process' child gets to this location, and just
	   one time */
	else if (setoptions(pid, PTRACE_O_TRACEFORK) < 0) {
	  perror("ptrace(PTRACE_SETOPTIONS, ...)");
	  return 1;
	}
	else
	  signal = SIGSTOP;
      }
      if (restart(pid, signal) < 0) {
	perror("ptrace(PTRACE_CONT, ...)");
	return 1;
      }
    }
  }
}

Some of these tricks were learned from code written by someone who
until recently worked at my company.  There are no comments in his
code describing the origin of these ideas.

John