granicus.if.org Git - strace/blob - strace.c

   1 /*
   2  * Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
   3  * Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
   4  * Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
   5  * Copyright (c) 1996-1999 Wichert Akkerman <wichert@cistron.nl>
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. The name of the author may not be used to endorse or promote products
  17  *    derived from this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 #include "defs.h"
  32 #include <stdarg.h>
  33 #include <sys/param.h>
  34 #include <fcntl.h>
  35 #include <sys/resource.h>
  36 #include <sys/wait.h>
  37 #include <sys/stat.h>
  38 #include <pwd.h>
  39 #include <grp.h>
  40 #include <dirent.h>
  41 #include <sys/utsname.h>
  42 #if defined(IA64)
  43 # include <asm/ptrace_offsets.h>
  44 #endif
  45 /* In some libc, these aren't declared. Do it ourself: */
  46 extern char **environ;
  47 extern int optind;
  48 extern char *optarg;
  49
  50
  51 #if defined __NR_tkill
  52 # define my_tkill(tid, sig) syscall(__NR_tkill, (tid), (sig))
  53 #else
  54    /* kill() may choose arbitrarily the target task of the process group
  55       while we later wait on a that specific TID.  PID process waits become
  56       TID task specific waits for a process under ptrace(2).  */
  57 # warning "Neither tkill(2) nor tgkill(2) available, risk of strace hangs!"
  58 # define my_tkill(tid, sig) kill((tid), (sig))
  59 #endif
  60
  61 #undef KERNEL_VERSION
  62 #define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))
  63
  64 cflag_t cflag = CFLAG_NONE;
  65 unsigned int followfork = 0;
  66 unsigned int ptrace_setoptions = 0;
  67 unsigned int xflag = 0;
  68 bool debug_flag = 0;
  69 bool Tflag = 0;
  70 bool qflag = 0;
  71 /* Which WSTOPSIG(status) value marks syscall traps? */
  72 static unsigned int syscall_trap_sig = SIGTRAP;
  73 static unsigned int tflag = 0;
  74 static bool iflag = 0;
  75 static bool rflag = 0;
  76 static bool print_pid_pfx = 0;
  77
  78 /* -I n */
  79 enum {
  80     INTR_NOT_SET        = 0,
  81     INTR_ANYWHERE       = 1, /* don't block/ignore any signals */
  82     INTR_WHILE_WAIT     = 2, /* block fatal signals while decoding syscall. default */
  83     INTR_NEVER          = 3, /* block fatal signals. default if '-o FILE PROG' */
  84     INTR_BLOCK_TSTP_TOO = 4, /* block fatal signals and SIGTSTP (^Z) */
  85     NUM_INTR_OPTS
  86 };
  87 static int opt_intr;
  88 /* We play with signal mask only if this mode is active: */
  89 #define interactive (opt_intr == INTR_WHILE_WAIT)
  90
  91 /*
  92  * daemonized_tracer supports -D option.
  93  * With this option, strace forks twice.
  94  * Unlike normal case, with -D *grandparent* process exec's,
  95  * becoming a traced process. Child exits (this prevents traced process
  96  * from having children it doesn't expect to have), and grandchild
  97  * attaches to grandparent similarly to strace -p PID.
  98  * This allows for more transparent interaction in cases
  99  * when process and its parent are communicating via signals,
 100  * wait() etc. Without -D, strace process gets lodged in between,
 101  * disrupting parent<->child link.
 102  */
 103 static bool daemonized_tracer = 0;
 104
 105 #ifdef USE_SEIZE
 106 static int post_attach_sigstop = TCB_IGNORE_ONE_SIGSTOP;
 107 # define use_seize (post_attach_sigstop == 0)
 108 #else
 109 # define post_attach_sigstop TCB_IGNORE_ONE_SIGSTOP
 110 # define use_seize 0
 111 #endif
 112
 113 /* Sometimes we want to print only succeeding syscalls. */
 114 bool not_failing_only = 0;
 115
 116 /* Show path associated with fd arguments */
 117 bool show_fd_path = 0;
 118
 119 /* are we filtering traces based on paths? */
 120 bool tracing_paths = 0;
 121
 122 static bool detach_on_execve = 0;
 123 static bool skip_startup_execve = 0;
 124
 125 static int exit_code = 0;
 126 static int strace_child = 0;
 127 static int strace_tracer_pid = 0;
 128
 129 static char *username = NULL;
 130 static uid_t run_uid;
 131 static gid_t run_gid;
 132
 133 unsigned int max_strlen = DEFAULT_STRLEN;
 134 static unsigned int acolumn = DEFAULT_ACOLUMN;
 135 static char *acolumn_spaces;
 136 static char *outfname = NULL;
 137 static FILE *outf;
 138 struct tcb *printing_tcp = NULL;
 139 static unsigned int curcol;
 140 static struct tcb **tcbtab;
 141 static unsigned int nprocs, tcbtabsize;
 142 static const char *progname;
 143
 144 static unsigned os_release; /* generated from uname()'s u.release */
 145
 146 static int detach(struct tcb *tcp);
 147 static int trace(void);
 148 static void cleanup(void);
 149 static void interrupt(int sig);
 150 static sigset_t empty_set, blocked_set;
 151
 152 #ifdef HAVE_SIG_ATOMIC_T
 153 static volatile sig_atomic_t interrupted;
 154 #else
 155 static volatile int interrupted;
 156 #endif
 157
 158 #ifndef HAVE_STRERROR
 159
 160 #if !HAVE_DECL_SYS_ERRLIST
 161 extern int sys_nerr;
 162 extern char *sys_errlist[];
 163 #endif
 164
 165 const char *
 166 strerror(int err_no)
 167 {
 168         static char buf[sizeof("Unknown error %d") + sizeof(int)*3];
 169
 170         if (err_no < 1 || err_no >= sys_nerr) {
 171                 sprintf(buf, "Unknown error %d", err_no);
 172                 return buf;
 173         }
 174         return sys_errlist[err_no];
 175 }
 176
 177 #endif /* HAVE_STERRROR */
 178
 179 static void
 180 usage(FILE *ofp, int exitval)
 181 {
 182         fprintf(ofp, "\
 183 usage: strace [-CdDffhiqrtttTvVxxy] [-I n] [-a column] [-e expr]... [-o file]\n\
 184               [-p pid]... [-s strsize] [-u username] [-E var=val]...\n\
 185               [-P path] [PROG [ARGS]]\n\
 186    or: strace -c [-D] [-I n] [-e expr]... [-O overhead] [-S sortby] [-E var=val]...\n\
 187               [PROG [ARGS]]\n\
 188 -c -- count time, calls, and errors for each syscall and report summary\n\
 189 -C -- like -c but also print regular output while processes are running\n\
 190 -d -- enable debug output to stderr\n\
 191 -D -- run tracer process as a detached grandchild, not as parent\n\
 192 -f -- follow forks, -ff -- with output into separate files\n\
 193 -F -- attempt to follow vforks (deprecated, use -f)\n\
 194 -i -- print instruction pointer at time of syscall\n\
 195 -I interruptible\n\
 196    1: no signals are blocked\n\
 197    2: fatal signals are blocked while decoding syscall (default)\n\
 198    3: fatal signals are always blocked (default if '-o FILE PROG')\n\
 199    4: fatal signals and SIGTSTP (^Z) are always blocked\n\
 200       (useful to make 'strace -o FILE PROG' not stop on ^Z)\n\
 201 -q -- suppress messages about attaching, detaching, etc.\n\
 202 -r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs\n\
 203 -T -- print time spent in each syscall\n\
 204 -v -- verbose mode: print unabbreviated argv, stat, termios, etc. args\n\
 205 -x -- print non-ascii strings in hex, -xx -- print all strings in hex\n\
 206 -y -- print paths associated with file descriptor arguments\n\
 207 -h -- print help message\n\
 208 -V -- print version\n\
 209 -a column -- alignment COLUMN for printing syscall results (default %d)\n\
 210 -e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...\n\
 211    options: trace, abbrev, verbose, raw, signal, read, or write\n\
 212 -o file -- send trace output to FILE instead of stderr\n\
 213 -O overhead -- set overhead for tracing syscalls to OVERHEAD usecs\n\
 214 -p pid -- trace process with process id PID, may be repeated\n\
 215 -s strsize -- limit length of print strings to STRSIZE chars (default %d)\n\
 216 -S sortby -- sort syscall counts by: time, calls, name, nothing (default %s)\n\
 217 -u username -- run command as username handling setuid and/or setgid\n\
 218 -E var=val -- put var=val in the environment for command\n\
 219 -E var -- remove var from the environment for command\n\
 220 -P path -- trace accesses to path\n\
 221 "
 222 /* this is broken, so don't document it
 223 -z -- print only succeeding syscalls\n\
 224  */
 225 /* experimental, don't document it yet (option letter may change in the future!)
 226 -b -- detach on successful execve\n\
 227  */
 228 , DEFAULT_ACOLUMN, DEFAULT_STRLEN, DEFAULT_SORTBY);
 229         exit(exitval);
 230 }
 231
 232 static void die(void) __attribute__ ((noreturn));
 233 static void die(void)
 234 {
 235         if (strace_tracer_pid == getpid()) {
 236                 cflag = 0;
 237                 cleanup();
 238         }
 239         exit(1);
 240 }
 241
 242 static void verror_msg(int err_no, const char *fmt, va_list p)
 243 {
 244         char *msg;
 245
 246         fflush(NULL);
 247
 248         /* We want to print entire message with single fprintf to ensure
 249          * message integrity if stderr is shared with other programs.
 250          * Thus we use vasprintf + single fprintf.
 251          */
 252         msg = NULL;
 253         if (vasprintf(&msg, fmt, p) >= 0) {
 254                 if (err_no)
 255                         fprintf(stderr, "%s: %s: %s\n", progname, msg, strerror(err_no));
 256                 else
 257                         fprintf(stderr, "%s: %s\n", progname, msg);
 258                 free(msg);
 259         } else {
 260                 /* malloc in vasprintf failed, try it without malloc */
 261                 fprintf(stderr, "%s: ", progname);
 262                 vfprintf(stderr, fmt, p);
 263                 if (err_no)
 264                         fprintf(stderr, ": %s\n", strerror(err_no));
 265                 else
 266                         putc('\n', stderr);
 267         }
 268         /* We don't switch stderr to buffered, thus fprintf(stderr)
 269          * always flushes its output and this is not necessary: */
 270         /* fflush(stderr); */
 271 }
 272
 273 void error_msg(const char *fmt, ...)
 274 {
 275         va_list p;
 276         va_start(p, fmt);
 277         verror_msg(0, fmt, p);
 278         va_end(p);
 279 }
 280
 281 void error_msg_and_die(const char *fmt, ...)
 282 {
 283         va_list p;
 284         va_start(p, fmt);
 285         verror_msg(0, fmt, p);
 286         die();
 287 }
 288
 289 void perror_msg(const char *fmt, ...)
 290 {
 291         va_list p;
 292         va_start(p, fmt);
 293         verror_msg(errno, fmt, p);
 294         va_end(p);
 295 }
 296
 297 void perror_msg_and_die(const char *fmt, ...)
 298 {
 299         va_list p;
 300         va_start(p, fmt);
 301         verror_msg(errno, fmt, p);
 302         die();
 303 }
 304
 305 void die_out_of_memory(void)
 306 {
 307         static bool recursed = 0;
 308         if (recursed)
 309                 exit(1);
 310         recursed = 1;
 311         error_msg_and_die("Out of memory");
 312 }
 313
 314 /* Glue for systems without a MMU that cannot provide fork() */
 315 #ifdef HAVE_FORK
 316 # define strace_vforked 0
 317 #else
 318 # define strace_vforked 1
 319 # define fork()         vfork()
 320 #endif
 321
 322 #ifdef USE_SEIZE
 323 static int
 324 ptrace_attach_or_seize(int pid)
 325 {
 326         int r;
 327         if (!use_seize)
 328                 return ptrace(PTRACE_ATTACH, pid, 0, 0);
 329         r = ptrace(PTRACE_SEIZE, pid, 0, PTRACE_SEIZE_DEVEL);
 330         if (r)
 331                 return r;
 332         r = ptrace(PTRACE_INTERRUPT, pid, 0, 0);
 333         return r;
 334 }
 335 #else
 336 # define ptrace_attach_or_seize(pid) ptrace(PTRACE_ATTACH, (pid), 0, 0)
 337 #endif
 338
 339 static void
 340 set_cloexec_flag(int fd)
 341 {
 342         int flags, newflags;
 343
 344         flags = fcntl(fd, F_GETFD);
 345         if (flags < 0) {
 346                 /* Can happen only if fd is bad.
 347                  * Should never happen: if it does, we have a bug
 348                  * in the caller. Therefore we just abort
 349                  * instead of propagating the error.
 350                  */
 351                 perror_msg_and_die("fcntl(%d, F_GETFD)", fd);
 352         }
 353
 354         newflags = flags | FD_CLOEXEC;
 355         if (flags == newflags)
 356                 return;
 357
 358         fcntl(fd, F_SETFD, newflags); /* never fails */
 359 }
 360
 361 static void kill_save_errno(pid_t pid, int sig)
 362 {
 363         int saved_errno = errno;
 364
 365         (void) kill(pid, sig);
 366         errno = saved_errno;
 367 }
 368
 369 void
 370 tprintf(const char *fmt, ...)
 371 {
 372         va_list args;
 373
 374         va_start(args, fmt);
 375         if (outf) {
 376                 int n = vfprintf(outf, fmt, args);
 377                 if (n < 0) {
 378                         if (outf != stderr)
 379                                 perror(outfname == NULL
 380                                        ? "<writing to pipe>" : outfname);
 381                 } else
 382                         curcol += n;
 383         }
 384         va_end(args);
 385 }
 386
 387 void
 388 tprints(const char *str)
 389 {
 390         if (outf) {
 391                 int n = fputs(str, outf);
 392                 if (n >= 0) {
 393                         curcol += strlen(str);
 394                         return;
 395                 }
 396                 if (outf != stderr)
 397                         perror(outfname == NULL
 398                                ? "<writing to pipe>" : outfname);
 399         }
 400 }
 401
 402 void
 403 line_ended(void)
 404 {
 405         curcol = 0;
 406         fflush(outf);
 407         if (!printing_tcp)
 408                 return;
 409         printing_tcp->curcol = 0;
 410         printing_tcp = NULL;
 411 }
 412
 413 void
 414 printleader(struct tcb *tcp)
 415 {
 416         /* If -ff, "previous tcb we printed" is always the same as current,
 417          * because we have per-tcb output files.
 418          */
 419         if (followfork >= 2)
 420                 printing_tcp = tcp;
 421
 422         if (printing_tcp) {
 423                 outf = printing_tcp->outf;
 424                 curcol = printing_tcp->curcol;
 425                 if (printing_tcp->ptrace_errno) {
 426                         if (printing_tcp->flags & TCB_INSYSCALL) {
 427                                 tprints(" <unavailable>) ");
 428                                 tabto();
 429                         }
 430                         tprints("= ? <unavailable>\n");
 431                         printing_tcp->ptrace_errno = 0;
 432                         printing_tcp->curcol = 0;
 433                 }
 434                 if (printing_tcp->curcol != 0 && (followfork < 2 || printing_tcp == tcp)) {
 435                         /*
 436                          * case 1: we have a shared log (i.e. not -ff), and last line
 437                          * wasn't finished (same or different tcb, doesn't matter).
 438                          * case 2: split log, we are the same tcb, but our last line
 439                          * didn't finish ("SIGKILL nuked us after syscall entry" etc).
 440                          */
 441                         tprints(" <unfinished ...>\n");
 442                         printing_tcp->flags |= TCB_REPRINT;
 443                         printing_tcp->curcol = 0;
 444                 }
 445         }
 446
 447         printing_tcp = tcp;
 448         outf = tcp->outf;
 449         curcol = 0;
 450
 451         if (print_pid_pfx)
 452                 tprintf("%-5d ", tcp->pid);
 453         else if (nprocs > 1 && !outfname)
 454                 tprintf("[pid %5u] ", tcp->pid);
 455
 456         if (tflag) {
 457                 char str[sizeof("HH:MM:SS")];
 458                 struct timeval tv, dtv;
 459                 static struct timeval otv;
 460
 461                 gettimeofday(&tv, NULL);
 462                 if (rflag) {
 463                         if (otv.tv_sec == 0)
 464                                 otv = tv;
 465                         tv_sub(&dtv, &tv, &otv);
 466                         tprintf("%6ld.%06ld ",
 467                                 (long) dtv.tv_sec, (long) dtv.tv_usec);
 468                         otv = tv;
 469                 }
 470                 else if (tflag > 2) {
 471                         tprintf("%ld.%06ld ",
 472                                 (long) tv.tv_sec, (long) tv.tv_usec);
 473                 }
 474                 else {
 475                         time_t local = tv.tv_sec;
 476                         strftime(str, sizeof(str), "%T", localtime(&local));
 477                         if (tflag > 1)
 478                                 tprintf("%s.%06ld ", str, (long) tv.tv_usec);
 479                         else
 480                                 tprintf("%s ", str);
 481                 }
 482         }
 483         if (iflag)
 484                 printcall(tcp);
 485 }
 486
 487 void
 488 tabto(void)
 489 {
 490         if (curcol < acolumn)
 491                 tprints(acolumn_spaces + curcol);
 492 }
 493
 494 /*
 495  * When strace is setuid executable, we have to swap uids
 496  * before and after filesystem and process management operations.
 497  */
 498 static void
 499 swap_uid(void)
 500 {
 501         int euid = geteuid(), uid = getuid();
 502
 503         if (euid != uid && setreuid(euid, uid) < 0) {
 504                 perror_msg_and_die("setreuid");
 505         }
 506 }
 507
 508 #if _LFS64_LARGEFILE
 509 # define fopen_for_output fopen64
 510 #else
 511 # define fopen_for_output fopen
 512 #endif
 513
 514 static FILE *
 515 strace_fopen(const char *path)
 516 {
 517         FILE *fp;
 518
 519         swap_uid();
 520         fp = fopen_for_output(path, "w");
 521         if (!fp)
 522                 perror_msg_and_die("Can't fopen '%s'", path);
 523         swap_uid();
 524         set_cloexec_flag(fileno(fp));
 525         return fp;
 526 }
 527
 528 static int popen_pid = 0;
 529
 530 #ifndef _PATH_BSHELL
 531 # define _PATH_BSHELL "/bin/sh"
 532 #endif
 533
 534 /*
 535  * We cannot use standard popen(3) here because we have to distinguish
 536  * popen child process from other processes we trace, and standard popen(3)
 537  * does not export its child's pid.
 538  */
 539 static FILE *
 540 strace_popen(const char *command)
 541 {
 542         FILE *fp;
 543         int fds[2];
 544
 545         swap_uid();
 546         if (pipe(fds) < 0)
 547                 perror_msg_and_die("pipe");
 548
 549         set_cloexec_flag(fds[1]); /* never fails */
 550
 551         popen_pid = vfork();
 552         if (popen_pid == -1)
 553                 perror_msg_and_die("vfork");
 554
 555         if (popen_pid == 0) {
 556                 /* child */
 557                 close(fds[1]);
 558                 if (fds[0] != 0) {
 559                         if (dup2(fds[0], 0))
 560                                 perror_msg_and_die("dup2");
 561                         close(fds[0]);
 562                 }
 563                 execl(_PATH_BSHELL, "sh", "-c", command, NULL);
 564                 perror_msg_and_die("Can't execute '%s'", _PATH_BSHELL);
 565         }
 566
 567         /* parent */
 568         close(fds[0]);
 569         swap_uid();
 570         fp = fdopen(fds[1], "w");
 571         if (!fp)
 572                 die_out_of_memory();
 573         return fp;
 574 }
 575
 576 static void
 577 newoutf(struct tcb *tcp)
 578 {
 579         if (outfname && followfork >= 2) {
 580                 char name[520 + sizeof(int) * 3];
 581                 sprintf(name, "%.512s.%u", outfname, tcp->pid);
 582                 tcp->outf = strace_fopen(name);
 583         }
 584 }
 585
 586 static void
 587 process_opt_p_list(char *opt)
 588 {
 589         while (*opt) {
 590                 /*
 591                  * We accept -p PID,PID; -p "`pidof PROG`"; -p "`pgrep PROG`".
 592                  * pidof uses space as delim, pgrep uses newline. :(
 593                  */
 594                 int pid;
 595                 char *delim = opt + strcspn(opt, ", \n\t");
 596                 char c = *delim;
 597
 598                 *delim = '\0';
 599                 pid = atoi(opt); /* TODO: stricter parsing of the number? */
 600                 if (pid <= 0) {
 601                         error_msg("Invalid process id: '%s'", opt);
 602                         *delim = c;
 603                         return;
 604                 }
 605                 if (pid == strace_tracer_pid) {
 606                         error_msg("I'm sorry, I can't let you do that, Dave.");
 607                         *delim = c;
 608                         return;
 609                 }
 610                 *delim = c;
 611                 alloc_tcb(pid, 0);
 612                 if (c == '\0')
 613                         break;
 614                 opt = delim + 1;
 615         }
 616 }
 617
 618 static void
 619 startup_attach(void)
 620 {
 621         int tcbi;
 622         struct tcb *tcp;
 623
 624         /*
 625          * Block user interruptions as we would leave the traced
 626          * process stopped (process state T) if we would terminate in
 627          * between PTRACE_ATTACH and wait4() on SIGSTOP.
 628          * We rely on cleanup() from this point on.
 629          */
 630         if (interactive)
 631                 sigprocmask(SIG_BLOCK, &blocked_set, NULL);
 632
 633         if (daemonized_tracer) {
 634                 pid_t pid = fork();
 635                 if (pid < 0) {
 636                         perror_msg_and_die("fork");
 637                 }
 638                 if (pid) { /* parent */
 639                         /*
 640                          * Wait for grandchild to attach to straced process
 641                          * (grandparent). Grandchild SIGKILLs us after it attached.
 642                          * Grandparent's wait() is unblocked by our death,
 643                          * it proceeds to exec the straced program.
 644                          */
 645                         pause();
 646                         _exit(0); /* paranoia */
 647                 }
 648                 /* grandchild */
 649                 /* We will be the tracer process. Remember our new pid: */
 650                 strace_tracer_pid = getpid();
 651         }
 652
 653         for (tcbi = 0; tcbi < tcbtabsize; tcbi++) {
 654                 tcp = tcbtab[tcbi];
 655
 656                 if (!(tcp->flags & TCB_INUSE))
 657                         continue;
 658
 659                 /* Is this a process we should attach to, but not yet attached? */
 660                 if (tcp->flags & TCB_ATTACHED)
 661                         continue; /* no, we already attached it */
 662
 663                 /* Reinitialize the output since it may have changed */
 664                 tcp->outf = outf;
 665                 newoutf(tcp);
 666
 667                 if (followfork && !daemonized_tracer) {
 668                         char procdir[sizeof("/proc/%d/task") + sizeof(int) * 3];
 669                         DIR *dir;
 670
 671                         sprintf(procdir, "/proc/%d/task", tcp->pid);
 672                         dir = opendir(procdir);
 673                         if (dir != NULL) {
 674                                 unsigned int ntid = 0, nerr = 0;
 675                                 struct dirent *de;
 676
 677                                 while ((de = readdir(dir)) != NULL) {
 678                                         struct tcb *cur_tcp;
 679                                         int tid;
 680
 681                                         if (de->d_fileno == 0)
 682                                                 continue;
 683                                         tid = atoi(de->d_name);
 684                                         if (tid <= 0)
 685                                                 continue;
 686                                         ++ntid;
 687                                         if (ptrace_attach_or_seize(tid) < 0) {
 688                                                 ++nerr;
 689                                                 if (debug_flag)
 690                                                         fprintf(stderr, "attach to pid %d failed\n", tid);
 691                                                 continue;
 692                                         }
 693                                         if (debug_flag)
 694                                                 fprintf(stderr, "attach to pid %d succeeded\n", tid);
 695                                         cur_tcp = tcp;
 696                                         if (tid != tcp->pid)
 697                                                 cur_tcp = alloctcb(tid);
 698                                         cur_tcp->flags |= TCB_ATTACHED | TCB_STARTUP | post_attach_sigstop;
 699                                 }
 700                                 closedir(dir);
 701                                 if (interactive) {
 702                                         sigprocmask(SIG_SETMASK, &empty_set, NULL);
 703                                         if (interrupted)
 704                                                 goto ret;
 705                                         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
 706                                 }
 707                                 ntid -= nerr;
 708                                 if (ntid == 0) {
 709                                         perror("attach: ptrace(PTRACE_ATTACH, ...)");
 710                                         droptcb(tcp);
 711                                         continue;
 712                                 }
 713                                 if (!qflag) {
 714                                         fprintf(stderr, ntid > 1
 715 ? "Process %u attached with %u threads - interrupt to quit\n"
 716 : "Process %u attached - interrupt to quit\n",
 717                                                 tcp->pid, ntid);
 718                                 }
 719                                 if (!(tcp->flags & TCB_ATTACHED)) {
 720                                         /* -p PID, we failed to attach to PID itself
 721                                          * but did attach to some of its sibling threads.
 722                                          * Drop PID's tcp.
 723                                          */
 724                                         droptcb(tcp);
 725                                 }
 726                                 continue;
 727                         } /* if (opendir worked) */
 728                 } /* if (-f) */
 729                 if (ptrace_attach_or_seize(tcp->pid) < 0) {
 730                         perror("attach: ptrace(PTRACE_ATTACH, ...)");
 731                         droptcb(tcp);
 732                         continue;
 733                 }
 734                 tcp->flags |= TCB_ATTACHED | TCB_STARTUP | post_attach_sigstop;
 735                 if (debug_flag)
 736                         fprintf(stderr, "attach to pid %d (main) succeeded\n", tcp->pid);
 737
 738                 if (daemonized_tracer) {
 739                         /*
 740                          * Make parent go away.
 741                          * Also makes grandparent's wait() unblock.
 742                          */
 743                         kill(getppid(), SIGKILL);
 744                 }
 745
 746                 if (!qflag)
 747                         fprintf(stderr,
 748                                 "Process %u attached - interrupt to quit\n",
 749                                 tcp->pid);
 750         } /* for each tcbtab[] */
 751
 752  ret:
 753         if (interactive)
 754                 sigprocmask(SIG_SETMASK, &empty_set, NULL);
 755 }
 756
 757 static void
 758 startup_child(char **argv)
 759 {
 760         struct stat statbuf;
 761         const char *filename;
 762         char pathname[MAXPATHLEN];
 763         int pid = 0;
 764         struct tcb *tcp;
 765
 766         filename = argv[0];
 767         if (strchr(filename, '/')) {
 768                 if (strlen(filename) > sizeof pathname - 1) {
 769                         errno = ENAMETOOLONG;
 770                         perror_msg_and_die("exec");
 771                 }
 772                 strcpy(pathname, filename);
 773         }
 774 #ifdef USE_DEBUGGING_EXEC
 775         /*
 776          * Debuggers customarily check the current directory
 777          * first regardless of the path but doing that gives
 778          * security geeks a panic attack.
 779          */
 780         else if (stat(filename, &statbuf) == 0)
 781                 strcpy(pathname, filename);
 782 #endif /* USE_DEBUGGING_EXEC */
 783         else {
 784                 const char *path;
 785                 int m, n, len;
 786
 787                 for (path = getenv("PATH"); path && *path; path += m) {
 788                         const char *colon = strchr(path, ':');
 789                         if (colon) {
 790                                 n = colon - path;
 791                                 m = n + 1;
 792                         }
 793                         else
 794                                 m = n = strlen(path);
 795                         if (n == 0) {
 796                                 if (!getcwd(pathname, MAXPATHLEN))
 797                                         continue;
 798                                 len = strlen(pathname);
 799                         }
 800                         else if (n > sizeof pathname - 1)
 801                                 continue;
 802                         else {
 803                                 strncpy(pathname, path, n);
 804                                 len = n;
 805                         }
 806                         if (len && pathname[len - 1] != '/')
 807                                 pathname[len++] = '/';
 808                         strcpy(pathname + len, filename);
 809                         if (stat(pathname, &statbuf) == 0 &&
 810                             /* Accept only regular files
 811                                with some execute bits set.
 812                                XXX not perfect, might still fail */
 813                             S_ISREG(statbuf.st_mode) &&
 814                             (statbuf.st_mode & 0111))
 815                                 break;
 816                 }
 817         }
 818         if (stat(pathname, &statbuf) < 0) {
 819                 perror_msg_and_die("Can't stat '%s'", filename);
 820         }
 821         strace_child = pid = fork();
 822         if (pid < 0) {
 823                 perror_msg_and_die("fork");
 824         }
 825         if ((pid != 0 && daemonized_tracer) /* -D: parent to become a traced process */
 826          || (pid == 0 && !daemonized_tracer) /* not -D: child to become a traced process */
 827         ) {
 828                 pid = getpid();
 829                 if (outf != stderr)
 830                         close(fileno(outf));
 831                 if (!daemonized_tracer && !use_seize) {
 832                         if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0) {
 833                                 perror_msg_and_die("ptrace(PTRACE_TRACEME, ...)");
 834                         }
 835                 }
 836
 837                 if (username != NULL) {
 838                         uid_t run_euid = run_uid;
 839                         gid_t run_egid = run_gid;
 840
 841                         if (statbuf.st_mode & S_ISUID)
 842                                 run_euid = statbuf.st_uid;
 843                         if (statbuf.st_mode & S_ISGID)
 844                                 run_egid = statbuf.st_gid;
 845                         /*
 846                          * It is important to set groups before we
 847                          * lose privileges on setuid.
 848                          */
 849                         if (initgroups(username, run_gid) < 0) {
 850                                 perror_msg_and_die("initgroups");
 851                         }
 852                         if (setregid(run_gid, run_egid) < 0) {
 853                                 perror_msg_and_die("setregid");
 854                         }
 855                         if (setreuid(run_uid, run_euid) < 0) {
 856                                 perror_msg_and_die("setreuid");
 857                         }
 858                 }
 859                 else if (geteuid() != 0)
 860                         setreuid(run_uid, run_uid);
 861
 862                 if (!daemonized_tracer) {
 863                         /*
 864                          * Induce a ptrace stop. Tracer (our parent)
 865                          * will resume us with PTRACE_SYSCALL and display
 866                          * the immediately following execve syscall.
 867                          * Can't do this on NOMMU systems, we are after
 868                          * vfork: parent is blocked, stopping would deadlock.
 869                          */
 870                         if (!strace_vforked)
 871                                 kill(pid, SIGSTOP);
 872                 } else {
 873                         alarm(3);
 874                         /* we depend on SIGCHLD set to SIG_DFL by init code */
 875                         /* if it happens to be SIG_IGN'ed, wait won't block */
 876                         wait(NULL);
 877                         alarm(0);
 878                 }
 879
 880                 execv(pathname, argv);
 881                 perror_msg_and_die("exec");
 882         }
 883
 884         /* We are the tracer */
 885
 886         if (!daemonized_tracer) {
 887                 if (!use_seize) {
 888                         /* child did PTRACE_TRACEME, nothing to do in parent */
 889                 } else {
 890                         if (!strace_vforked) {
 891                                 /* Wait until child stopped itself */
 892                                 int status;
 893                                 while (waitpid(pid, &status, WSTOPPED) < 0) {
 894                                         if (errno == EINTR)
 895                                                 continue;
 896                                         perror_msg_and_die("waitpid");
 897                                 }
 898                                 if (!WIFSTOPPED(status) || WSTOPSIG(status) != SIGSTOP) {
 899                                         kill_save_errno(pid, SIGKILL);
 900                                         perror_msg_and_die("Unexpected wait status %x", status);
 901                                 }
 902                         }
 903                         /* Else: vforked case, we have no way to sync.
 904                          * Just attach to it as soon as possible.
 905                          * This means that we may miss a few first syscalls...
 906                          */
 907
 908                         if (ptrace_attach_or_seize(pid)) {
 909                                 kill_save_errno(pid, SIGKILL);
 910                                 perror_msg_and_die("Can't attach to %d", pid);
 911                         }
 912                         if (!strace_vforked)
 913                                 kill(pid, SIGCONT);
 914                 }
 915                 tcp = alloctcb(pid);
 916                 if (!strace_vforked)
 917                         tcp->flags |= TCB_ATTACHED | TCB_STRACE_CHILD | TCB_STARTUP | post_attach_sigstop;
 918                 else
 919                         tcp->flags |= TCB_ATTACHED | TCB_STRACE_CHILD | TCB_STARTUP;
 920         }
 921         else {
 922                 /* With -D, *we* are child here, IOW: different pid. Fetch it: */
 923                 strace_tracer_pid = getpid();
 924                 /* The tracee is our parent: */
 925                 pid = getppid();
 926                 alloctcb(pid);
 927                 /* attaching will be done later, by startup_attach */
 928         }
 929 }
 930
 931 /*
 932  * Test whether the kernel support PTRACE_O_TRACECLONE et al options.
 933  * First fork a new child, call ptrace with PTRACE_SETOPTIONS on it,
 934  * and then see which options are supported by the kernel.
 935  */
 936 static void
 937 test_ptrace_setoptions_followfork(void)
 938 {
 939         int pid, expected_grandchild = 0, found_grandchild = 0;
 940         const unsigned int test_options = PTRACE_O_TRACECLONE |
 941                                           PTRACE_O_TRACEFORK |
 942                                           PTRACE_O_TRACEVFORK;
 943
 944         pid = fork();
 945         if (pid < 0)
 946                 perror_msg_and_die("fork");
 947         if (pid == 0) {
 948                 pid = getpid();
 949                 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0)
 950                         perror_msg_and_die("%s: PTRACE_TRACEME doesn't work",
 951                                            __func__);
 952                 kill_save_errno(pid, SIGSTOP);
 953                 if (fork() < 0)
 954                         perror_msg_and_die("fork");
 955                 _exit(0);
 956         }
 957
 958         while (1) {
 959                 int status, tracee_pid;
 960
 961                 errno = 0;
 962                 tracee_pid = wait(&status);
 963                 if (tracee_pid <= 0) {
 964                         if (errno == EINTR)
 965                                 continue;
 966                         if (errno == ECHILD)
 967                                 break;
 968                         kill_save_errno(pid, SIGKILL);
 969                         perror_msg_and_die("%s: unexpected wait result %d",
 970                                            __func__, tracee_pid);
 971                 }
 972                 if (WIFEXITED(status)) {
 973                         if (WEXITSTATUS(status)) {
 974                                 if (tracee_pid != pid)
 975                                         kill_save_errno(pid, SIGKILL);
 976                                 error_msg_and_die("%s: unexpected exit status %u",
 977                                                   __func__, WEXITSTATUS(status));
 978                         }
 979                         continue;
 980                 }
 981                 if (WIFSIGNALED(status)) {
 982                         if (tracee_pid != pid)
 983                                 kill_save_errno(pid, SIGKILL);
 984                         error_msg_and_die("%s: unexpected signal %u",
 985                                           __func__, WTERMSIG(status));
 986                 }
 987                 if (!WIFSTOPPED(status)) {
 988                         if (tracee_pid != pid)
 989                                 kill_save_errno(tracee_pid, SIGKILL);
 990                         kill_save_errno(pid, SIGKILL);
 991                         error_msg_and_die("%s: unexpected wait status %x",
 992                                           __func__, status);
 993                 }
 994                 if (tracee_pid != pid) {
 995                         found_grandchild = tracee_pid;
 996                         if (ptrace(PTRACE_CONT, tracee_pid, 0, 0) < 0) {
 997                                 kill_save_errno(tracee_pid, SIGKILL);
 998                                 kill_save_errno(pid, SIGKILL);
 999                                 perror_msg_and_die("PTRACE_CONT doesn't work");
1000                         }
1001                         continue;
1002                 }
1003                 switch (WSTOPSIG(status)) {
1004                 case SIGSTOP:
1005                         if (ptrace(PTRACE_SETOPTIONS, pid, 0, test_options) < 0
1006                             && errno != EINVAL && errno != EIO)
1007                                 perror_msg("PTRACE_SETOPTIONS");
1008                         break;
1009                 case SIGTRAP:
1010                         if (status >> 16 == PTRACE_EVENT_FORK) {
1011                                 long msg = 0;
1012
1013                                 if (ptrace(PTRACE_GETEVENTMSG, pid,
1014                                            NULL, (long) &msg) == 0)
1015                                         expected_grandchild = msg;
1016                         }
1017                         break;
1018                 }
1019                 if (ptrace(PTRACE_SYSCALL, pid, 0, 0) < 0) {
1020                         kill_save_errno(pid, SIGKILL);
1021                         perror_msg_and_die("PTRACE_SYSCALL doesn't work");
1022                 }
1023         }
1024         if (expected_grandchild && expected_grandchild == found_grandchild) {
1025                 ptrace_setoptions |= test_options;
1026                 if (debug_flag)
1027                         fprintf(stderr, "ptrace_setoptions = %#x\n",
1028                                 ptrace_setoptions);
1029                 return;
1030         }
1031         error_msg("Test for PTRACE_O_TRACECLONE failed, "
1032                   "giving up using this feature.");
1033 }
1034
1035 /*
1036  * Test whether the kernel support PTRACE_O_TRACESYSGOOD.
1037  * First fork a new child, call ptrace(PTRACE_SETOPTIONS) on it,
1038  * and then see whether it will stop with (SIGTRAP | 0x80).
1039  *
1040  * Use of this option enables correct handling of user-generated SIGTRAPs,
1041  * and SIGTRAPs generated by special instructions such as int3 on x86:
1042  * _start:      .globl  _start
1043  *              int3
1044  *              movl    $42, %ebx
1045  *              movl    $1, %eax
1046  *              int     $0x80
1047  * (compile with: "gcc -nostartfiles -nostdlib -o int3 int3.S")
1048  */
1049 static void
1050 test_ptrace_setoptions_for_all(void)
1051 {
1052         const unsigned int test_options = PTRACE_O_TRACESYSGOOD |
1053                                           PTRACE_O_TRACEEXEC;
1054         int pid;
1055         int it_worked = 0;
1056
1057         pid = fork();
1058         if (pid < 0)
1059                 perror_msg_and_die("fork");
1060
1061         if (pid == 0) {
1062                 pid = getpid();
1063                 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0)
1064                         /* Note: exits with exitcode 1 */
1065                         perror_msg_and_die("%s: PTRACE_TRACEME doesn't work",
1066                                            __func__);
1067                 kill(pid, SIGSTOP);
1068                 _exit(0); /* parent should see entry into this syscall */
1069         }
1070
1071         while (1) {
1072                 int status, tracee_pid;
1073
1074                 errno = 0;
1075                 tracee_pid = wait(&status);
1076                 if (tracee_pid <= 0) {
1077                         if (errno == EINTR)
1078                                 continue;
1079                         kill_save_errno(pid, SIGKILL);
1080                         perror_msg_and_die("%s: unexpected wait result %d",
1081                                            __func__, tracee_pid);
1082                 }
1083                 if (WIFEXITED(status)) {
1084                         if (WEXITSTATUS(status) == 0)
1085                                 break;
1086                         error_msg_and_die("%s: unexpected exit status %u",
1087                                           __func__, WEXITSTATUS(status));
1088                 }
1089                 if (WIFSIGNALED(status)) {
1090                         error_msg_and_die("%s: unexpected signal %u",
1091                                           __func__, WTERMSIG(status));
1092                 }
1093                 if (!WIFSTOPPED(status)) {
1094                         kill(pid, SIGKILL);
1095                         error_msg_and_die("%s: unexpected wait status %x",
1096                                           __func__, status);
1097                 }
1098                 if (WSTOPSIG(status) == SIGSTOP) {
1099                         /*
1100                          * We don't check "options aren't accepted" error.
1101                          * If it happens, we'll never get (SIGTRAP | 0x80),
1102                          * and thus will decide to not use the option.
1103                          * IOW: the outcome of the test will be correct.
1104                          */
1105                         if (ptrace(PTRACE_SETOPTIONS, pid, 0L, test_options) < 0
1106                             && errno != EINVAL && errno != EIO)
1107                                 perror_msg("PTRACE_SETOPTIONS");
1108                 }
1109                 if (WSTOPSIG(status) == (SIGTRAP | 0x80)) {
1110                         it_worked = 1;
1111                 }
1112                 if (ptrace(PTRACE_SYSCALL, pid, 0L, 0L) < 0) {
1113                         kill_save_errno(pid, SIGKILL);
1114                         perror_msg_and_die("PTRACE_SYSCALL doesn't work");
1115                 }
1116         }
1117
1118         if (it_worked) {
1119                 syscall_trap_sig = (SIGTRAP | 0x80);
1120                 ptrace_setoptions |= test_options;
1121                 if (debug_flag)
1122                         fprintf(stderr, "ptrace_setoptions = %#x\n",
1123                                 ptrace_setoptions);
1124                 return;
1125         }
1126
1127         error_msg("Test for PTRACE_O_TRACESYSGOOD failed, "
1128                   "giving up using this feature.");
1129 }
1130
1131 # ifdef USE_SEIZE
1132 static void
1133 test_ptrace_seize(void)
1134 {
1135         int pid;
1136
1137         pid = fork();
1138         if (pid < 0)
1139                 perror_msg_and_die("fork");
1140
1141         if (pid == 0) {
1142                 pause();
1143                 _exit(0);
1144         }
1145
1146         /* PTRACE_SEIZE, unlike ATTACH, doesn't force tracee to trap.  After
1147          * attaching tracee continues to run unless a trap condition occurs.
1148          * PTRACE_SEIZE doesn't affect signal or group stop state.
1149          */
1150         if (ptrace(PTRACE_SEIZE, pid, 0, PTRACE_SEIZE_DEVEL) == 0) {
1151                 post_attach_sigstop = 0; /* this sets use_seize to 1 */
1152         } else if (debug_flag) {
1153                 fprintf(stderr, "PTRACE_SEIZE doesn't work\n");
1154         }
1155
1156         kill(pid, SIGKILL);
1157
1158         while (1) {
1159                 int status, tracee_pid;
1160
1161                 errno = 0;
1162                 tracee_pid = waitpid(pid, &status, 0);
1163                 if (tracee_pid <= 0) {
1164                         if (errno == EINTR)
1165                                 continue;
1166                         perror_msg_and_die("%s: unexpected wait result %d",
1167                                          __func__, tracee_pid);
1168                 }
1169                 if (WIFSIGNALED(status)) {
1170                         return;
1171                 }
1172                 error_msg_and_die("%s: unexpected wait status %x",
1173                                 __func__, status);
1174         }
1175 }
1176 # else /* !USE_SEIZE */
1177 #  define test_ptrace_seize() ((void)0)
1178 # endif
1179
1180 static unsigned
1181 get_os_release(void)
1182 {
1183         unsigned rel;
1184         const char *p;
1185         struct utsname u;
1186         if (uname(&u) < 0)
1187                 perror_msg_and_die("uname");
1188         /* u.release has this form: "3.2.9[-some-garbage]" */
1189         rel = 0;
1190         p = u.release;
1191         for (;;) {
1192                 if (!(*p >= '0' && *p <= '9'))
1193                         error_msg_and_die("Bad OS release string: '%s'", u.release);
1194                 /* Note: this open-codes KERNEL_VERSION(): */
1195                 rel = (rel << 8) | atoi(p);
1196                 if (rel >= KERNEL_VERSION(1,0,0))
1197                         break;
1198                 while (*p >= '0' && *p <= '9')
1199                         p++;
1200                 if (*p != '.')
1201                         error_msg_and_die("Bad OS release string: '%s'", u.release);
1202                 p++;
1203         }
1204         return rel;
1205 }
1206
1207 /*
1208  * Initialization part of main() was eating much stack (~0.5k),
1209  * which was unused after init.
1210  * We can reuse it if we move init code into a separate function.
1211  *
1212  * Don't want main() to inline us and defeat the reason
1213  * we have a separate function.
1214  */
1215 static void __attribute__ ((noinline))
1216 init(int argc, char *argv[])
1217 {
1218         struct tcb *tcp;
1219         int c;
1220         int optF = 0;
1221         struct sigaction sa;
1222
1223         progname = argv[0] ? argv[0] : "strace";
1224
1225         /* Make sure SIGCHLD has the default action so that waitpid
1226            definitely works without losing track of children.  The user
1227            should not have given us a bogus state to inherit, but he might
1228            have.  Arguably we should detect SIG_IGN here and pass it on
1229            to children, but probably noone really needs that.  */
1230         signal(SIGCHLD, SIG_DFL);
1231
1232         strace_tracer_pid = getpid();
1233
1234         os_release = get_os_release();
1235
1236         /* Allocate the initial tcbtab.  */
1237         tcbtabsize = argc;      /* Surely enough for all -p args.  */
1238         tcbtab = calloc(tcbtabsize, sizeof(tcbtab[0]));
1239         if (!tcbtab)
1240                 die_out_of_memory();
1241         tcp = calloc(tcbtabsize, sizeof(*tcp));
1242         if (!tcp)
1243                 die_out_of_memory();
1244         for (c = 0; c < tcbtabsize; c++)
1245                 tcbtab[c] = tcp++;
1246
1247         outf = stderr;
1248         set_sortby(DEFAULT_SORTBY);
1249         set_personality(DEFAULT_PERSONALITY);
1250         qualify("trace=all");
1251         qualify("abbrev=all");
1252         qualify("verbose=all");
1253         qualify("signal=all");
1254         while ((c = getopt(argc, argv,
1255                 "+bcCdfFhiqrtTvVxyz"
1256                 "D"
1257                 "a:e:o:O:p:s:S:u:E:P:I:")) != EOF) {
1258                 switch (c) {
1259                 case 'b':
1260                         detach_on_execve = 1;
1261                         break;
1262                 case 'c':
1263                         if (cflag == CFLAG_BOTH) {
1264                                 error_msg_and_die("-c and -C are mutually exclusive options");
1265                         }
1266                         cflag = CFLAG_ONLY_STATS;
1267                         break;
1268                 case 'C':
1269                         if (cflag == CFLAG_ONLY_STATS) {
1270                                 error_msg_and_die("-c and -C are mutually exclusive options");
1271                         }
1272                         cflag = CFLAG_BOTH;
1273                         break;
1274                 case 'd':
1275                         debug_flag = 1;
1276                         break;
1277                 case 'D':
1278                         daemonized_tracer = 1;
1279                         break;
1280                 case 'F':
1281                         optF = 1;
1282                         break;
1283                 case 'f':
1284                         followfork++;
1285                         break;
1286                 case 'h':
1287                         usage(stdout, 0);
1288                         break;
1289                 case 'i':
1290                         iflag = 1;
1291                         break;
1292                 case 'q':
1293                         qflag = 1;
1294                         break;
1295                 case 'r':
1296                         rflag = 1;
1297                         /* fall through to tflag++ */
1298                 case 't':
1299                         tflag++;
1300                         break;
1301                 case 'T':
1302                         Tflag = 1;
1303                         break;
1304                 case 'x':
1305                         xflag++;
1306                         break;
1307                 case 'y':
1308                         show_fd_path = 1;
1309                         break;
1310                 case 'v':
1311                         qualify("abbrev=none");
1312                         break;
1313                 case 'V':
1314                         printf("%s -- version %s\n", PACKAGE_NAME, VERSION);
1315                         exit(0);
1316                         break;
1317                 case 'z':
1318                         not_failing_only = 1;
1319                         break;
1320                 case 'a':
1321                         acolumn = atoi(optarg);
1322                         if (acolumn < 0)
1323                                 error_msg_and_die("Bad column width '%s'", optarg);
1324                         break;
1325                 case 'e':
1326                         qualify(optarg);
1327                         break;
1328                 case 'o':
1329                         outfname = strdup(optarg);
1330                         break;
1331                 case 'O':
1332                         set_overhead(atoi(optarg));
1333                         break;
1334                 case 'p':
1335                         process_opt_p_list(optarg);
1336                         break;
1337                 case 'P':
1338                         tracing_paths = 1;
1339                         if (pathtrace_select(optarg)) {
1340                                 error_msg_and_die("Failed to select path '%s'", optarg);
1341                         }
1342                         break;
1343                 case 's':
1344                         max_strlen = atoi(optarg);
1345                         if (max_strlen < 0) {
1346                                 error_msg_and_die("Invalid -%c argument: '%s'", c, optarg);
1347                         }
1348                         break;
1349                 case 'S':
1350                         set_sortby(optarg);
1351                         break;
1352                 case 'u':
1353                         username = strdup(optarg);
1354                         break;
1355                 case 'E':
1356                         if (putenv(optarg) < 0)
1357                                 die_out_of_memory();
1358                         break;
1359                 case 'I':
1360                         opt_intr = atoi(optarg);
1361                         if (opt_intr <= 0 || opt_intr >= NUM_INTR_OPTS) {
1362                                 error_msg_and_die("Invalid -%c argument: '%s'", c, optarg);
1363                         }
1364                         break;
1365                 default:
1366                         usage(stderr, 1);
1367                         break;
1368                 }
1369         }
1370         argv += optind;
1371         /* argc -= optind; - no need, argc is not used below */
1372
1373         acolumn_spaces = malloc(acolumn + 1);
1374         if (!acolumn_spaces)
1375                 die_out_of_memory();
1376         memset(acolumn_spaces, ' ', acolumn);
1377         acolumn_spaces[acolumn] = '\0';
1378
1379         /* Must have PROG [ARGS], or -p PID. Not both. */
1380         if (!argv[0] == !nprocs)
1381                 usage(stderr, 1);
1382
1383         if (nprocs != 0 && daemonized_tracer) {
1384                 error_msg_and_die("-D and -p are mutually exclusive options");
1385         }
1386
1387         if (!followfork)
1388                 followfork = optF;
1389
1390         if (followfork > 1 && cflag) {
1391                 error_msg_and_die("(-c or -C) and -ff are mutually exclusive options");
1392         }
1393
1394         /* See if they want to run as another user. */
1395         if (username != NULL) {
1396                 struct passwd *pent;
1397
1398                 if (getuid() != 0 || geteuid() != 0) {
1399                         error_msg_and_die("You must be root to use the -u option");
1400                 }
1401                 pent = getpwnam(username);
1402                 if (pent == NULL) {
1403                         error_msg_and_die("Cannot find user '%s'", username);
1404                 }
1405                 run_uid = pent->pw_uid;
1406                 run_gid = pent->pw_gid;
1407         }
1408         else {
1409                 run_uid = getuid();
1410                 run_gid = getgid();
1411         }
1412
1413         if (followfork)
1414                 test_ptrace_setoptions_followfork();
1415         test_ptrace_setoptions_for_all();
1416         test_ptrace_seize();
1417
1418         /* Check if they want to redirect the output. */
1419         if (outfname) {
1420                 /* See if they want to pipe the output. */
1421                 if (outfname[0] == '|' || outfname[0] == '!') {
1422                         /*
1423                          * We can't do the <outfname>.PID funny business
1424                          * when using popen, so prohibit it.
1425                          */
1426                         if (followfork > 1)
1427                                 error_msg_and_die("Piping the output and -ff are mutually exclusive");
1428                         outf = strace_popen(outfname + 1);
1429                 }
1430                 else if (followfork <= 1)
1431                         outf = strace_fopen(outfname);
1432         } else {
1433                 /* -ff without -o FILE is the same as single -f */
1434                 if (followfork > 1)
1435                         followfork = 1;
1436         }
1437
1438         if (!outfname || outfname[0] == '|' || outfname[0] == '!') {
1439                 char *buf = malloc(BUFSIZ);
1440                 if (!buf)
1441                         die_out_of_memory();
1442                 setvbuf(outf, buf, _IOLBF, BUFSIZ);
1443         }
1444         if (outfname && argv[0]) {
1445                 if (!opt_intr)
1446                         opt_intr = INTR_NEVER;
1447                 qflag = 1;
1448         }
1449         if (!opt_intr)
1450                 opt_intr = INTR_WHILE_WAIT;
1451
1452         /* argv[0]      -pPID   -oFILE  Default interactive setting
1453          * yes          0       0       INTR_WHILE_WAIT
1454          * no           1       0       INTR_WHILE_WAIT
1455          * yes          0       1       INTR_NEVER
1456          * no           1       1       INTR_WHILE_WAIT
1457          */
1458
1459         /* STARTUP_CHILD must be called before the signal handlers get
1460            installed below as they are inherited into the spawned process.
1461            Also we do not need to be protected by them as during interruption
1462            in the STARTUP_CHILD mode we kill the spawned process anyway.  */
1463         if (argv[0]) {
1464                 skip_startup_execve = 1;
1465                 startup_child(argv);
1466         }
1467
1468         sigemptyset(&empty_set);
1469         sigemptyset(&blocked_set);
1470         sa.sa_handler = SIG_IGN;
1471         sigemptyset(&sa.sa_mask);
1472         sa.sa_flags = 0;
1473         sigaction(SIGTTOU, &sa, NULL); /* SIG_IGN */
1474         sigaction(SIGTTIN, &sa, NULL); /* SIG_IGN */
1475         if (opt_intr != INTR_ANYWHERE) {
1476                 if (opt_intr == INTR_BLOCK_TSTP_TOO)
1477                         sigaction(SIGTSTP, &sa, NULL); /* SIG_IGN */
1478                 /*
1479                  * In interactive mode (if no -o OUTFILE, or -p PID is used),
1480                  * fatal signals are blocked while syscall stop is processed,
1481                  * and acted on in between, when waiting for new syscall stops.
1482                  * In non-interactive mode, signals are ignored.
1483                  */
1484                 if (opt_intr == INTR_WHILE_WAIT) {
1485                         sigaddset(&blocked_set, SIGHUP);
1486                         sigaddset(&blocked_set, SIGINT);
1487                         sigaddset(&blocked_set, SIGQUIT);
1488                         sigaddset(&blocked_set, SIGPIPE);
1489                         sigaddset(&blocked_set, SIGTERM);
1490                         sa.sa_handler = interrupt;
1491                 }
1492                 /* SIG_IGN, or set handler for these */
1493                 sigaction(SIGHUP, &sa, NULL);
1494                 sigaction(SIGINT, &sa, NULL);
1495                 sigaction(SIGQUIT, &sa, NULL);
1496                 sigaction(SIGPIPE, &sa, NULL);
1497                 sigaction(SIGTERM, &sa, NULL);
1498         }
1499         if (nprocs != 0 || daemonized_tracer)
1500                 startup_attach();
1501
1502         /* Do we want pids printed in our -o OUTFILE?
1503          * -ff: no (every pid has its own file); or
1504          * -f: yes (there can be more pids in the future); or
1505          * -p PID1,PID2: yes (there are already more than one pid)
1506          */
1507         print_pid_pfx = (outfname && followfork < 2 && (followfork == 1 || nprocs > 1));
1508 }
1509
1510 static void
1511 expand_tcbtab(void)
1512 {
1513         /* Allocate some more TCBs and expand the table.
1514            We don't want to relocate the TCBs because our
1515            callers have pointers and it would be a pain.
1516            So tcbtab is a table of pointers.  Since we never
1517            free the TCBs, we allocate a single chunk of many.  */
1518         int i = tcbtabsize;
1519         struct tcb *newtcbs = calloc(tcbtabsize, sizeof(newtcbs[0]));
1520         struct tcb **newtab = realloc(tcbtab, tcbtabsize * 2 * sizeof(tcbtab[0]));
1521         if (!newtab || !newtcbs)
1522                 die_out_of_memory();
1523         tcbtabsize *= 2;
1524         tcbtab = newtab;
1525         while (i < tcbtabsize)
1526                 tcbtab[i++] = newtcbs++;
1527 }
1528
1529 struct tcb *
1530 alloc_tcb(int pid, int command_options_parsed)
1531 {
1532         int i;
1533         struct tcb *tcp;
1534
1535         if (nprocs == tcbtabsize)
1536                 expand_tcbtab();
1537
1538         for (i = 0; i < tcbtabsize; i++) {
1539                 tcp = tcbtab[i];
1540                 if ((tcp->flags & TCB_INUSE) == 0) {
1541                         memset(tcp, 0, sizeof(*tcp));
1542                         tcp->pid = pid;
1543                         tcp->flags = TCB_INUSE;
1544                         tcp->outf = outf; /* Initialise to current out file */
1545 #if SUPPORTED_PERSONALITIES > 1
1546                         tcp->currpers = current_personality;
1547 #endif
1548                         nprocs++;
1549                         if (debug_flag)
1550                                 fprintf(stderr, "new tcb for pid %d, active tcbs:%d\n", tcp->pid, nprocs);
1551                         if (command_options_parsed)
1552                                 newoutf(tcp);
1553                         return tcp;
1554                 }
1555         }
1556         error_msg_and_die("bug in alloc_tcb");
1557 }
1558
1559 static struct tcb *
1560 pid2tcb(int pid)
1561 {
1562         int i;
1563
1564         if (pid <= 0)
1565                 return NULL;
1566
1567         for (i = 0; i < tcbtabsize; i++) {
1568                 struct tcb *tcp = tcbtab[i];
1569                 if (tcp->pid == pid && (tcp->flags & TCB_INUSE))
1570                         return tcp;
1571         }
1572
1573         return NULL;
1574 }
1575
1576 void
1577 droptcb(struct tcb *tcp)
1578 {
1579         if (tcp->pid == 0)
1580                 return;
1581
1582         nprocs--;
1583         if (debug_flag)
1584                 fprintf(stderr, "dropped tcb for pid %d, %d remain\n", tcp->pid, nprocs);
1585
1586         if (tcp->outf) {
1587                 if (outfname && followfork >= 2) {
1588                         if (tcp->curcol != 0)
1589                                 fprintf(tcp->outf, " <detached ...>\n");
1590                         fclose(tcp->outf);
1591                         if (outf == tcp->outf)
1592                                 outf = NULL;
1593                 } else {
1594                         if (printing_tcp == tcp && tcp->curcol != 0)
1595                                 fprintf(tcp->outf, " <detached ...>\n");
1596                         fflush(tcp->outf);
1597                 }
1598         }
1599
1600         if (printing_tcp == tcp)
1601                 printing_tcp = NULL;
1602
1603         memset(tcp, 0, sizeof(*tcp));
1604 }
1605
1606 /* detach traced process; continue with sig
1607  * Never call DETACH twice on the same process as both unattached and
1608  * attached-unstopped processes give the same ESRCH.  For unattached process we
1609  * would SIGSTOP it and wait for its SIGSTOP notification forever.
1610  */
1611 static int
1612 detach(struct tcb *tcp)
1613 {
1614         int error;
1615         int status, sigstop_expected;
1616
1617         if (tcp->flags & TCB_BPTSET)
1618                 clearbpt(tcp);
1619
1620         /*
1621          * Linux wrongly insists the child be stopped
1622          * before detaching.  Arghh.  We go through hoops
1623          * to make a clean break of things.
1624          */
1625 #if defined(SPARC)
1626 #undef PTRACE_DETACH
1627 #define PTRACE_DETACH PTRACE_SUNDETACH
1628 #endif
1629
1630         error = 0;
1631         sigstop_expected = 0;
1632         if (tcp->flags & TCB_ATTACHED) {
1633                 /*
1634                  * We attached but possibly didn't see the expected SIGSTOP.
1635                  * We must catch exactly one as otherwise the detached process
1636                  * would be left stopped (process state T).
1637                  */
1638                 sigstop_expected = (tcp->flags & TCB_IGNORE_ONE_SIGSTOP);
1639                 error = ptrace(PTRACE_DETACH, tcp->pid, (char *) 1, 0);
1640                 if (error == 0) {
1641                         /* On a clear day, you can see forever. */
1642                 }
1643                 else if (errno != ESRCH) {
1644                         /* Shouldn't happen. */
1645                         perror("detach: ptrace(PTRACE_DETACH, ...)");
1646                 }
1647                 else if (my_tkill(tcp->pid, 0) < 0) {
1648                         if (errno != ESRCH)
1649                                 perror("detach: checking sanity");
1650                 }
1651                 else if (!sigstop_expected && my_tkill(tcp->pid, SIGSTOP) < 0) {
1652                         if (errno != ESRCH)
1653                                 perror("detach: stopping child");
1654                 }
1655                 else
1656                         sigstop_expected = 1;
1657         }
1658
1659         if (sigstop_expected) {
1660                 for (;;) {
1661 #ifdef __WALL
1662                         if (waitpid(tcp->pid, &status, __WALL) < 0) {
1663                                 if (errno == ECHILD) /* Already gone.  */
1664                                         break;
1665                                 if (errno != EINVAL) {
1666                                         perror("detach: waiting");
1667                                         break;
1668                                 }
1669 #endif /* __WALL */
1670                                 /* No __WALL here.  */
1671                                 if (waitpid(tcp->pid, &status, 0) < 0) {
1672                                         if (errno != ECHILD) {
1673                                                 perror("detach: waiting");
1674                                                 break;
1675                                         }
1676 #ifdef __WCLONE
1677                                         /* If no processes, try clones.  */
1678                                         if (waitpid(tcp->pid, &status, __WCLONE) < 0) {
1679                                                 if (errno != ECHILD)
1680                                                         perror("detach: waiting");
1681                                                 break;
1682                                         }
1683 #endif /* __WCLONE */
1684                                 }
1685 #ifdef __WALL
1686                         }
1687 #endif
1688                         if (!WIFSTOPPED(status)) {
1689                                 /* Au revoir, mon ami. */
1690                                 break;
1691                         }
1692                         if (WSTOPSIG(status) == SIGSTOP) {
1693                                 ptrace_restart(PTRACE_DETACH, tcp, 0);
1694                                 break;
1695                         }
1696                         error = ptrace_restart(PTRACE_CONT, tcp,
1697                                         WSTOPSIG(status) == syscall_trap_sig ? 0
1698                                         : WSTOPSIG(status));
1699                         if (error < 0)
1700                                 break;
1701                 }
1702         }
1703
1704         if (!qflag && (tcp->flags & TCB_ATTACHED))
1705                 fprintf(stderr, "Process %u detached\n", tcp->pid);
1706
1707         droptcb(tcp);
1708
1709         return error;
1710 }
1711
1712 static void
1713 cleanup(void)
1714 {
1715         int i;
1716         struct tcb *tcp;
1717         int fatal_sig;
1718
1719         /* 'interrupted' is a volatile object, fetch it only once */
1720         fatal_sig = interrupted;
1721         if (!fatal_sig)
1722                 fatal_sig = SIGTERM;
1723
1724         for (i = 0; i < tcbtabsize; i++) {
1725                 tcp = tcbtab[i];
1726                 if (!(tcp->flags & TCB_INUSE))
1727                         continue;
1728                 if (debug_flag)
1729                         fprintf(stderr,
1730                                 "cleanup: looking at pid %u\n", tcp->pid);
1731                 if (tcp->flags & TCB_STRACE_CHILD) {
1732                         kill(tcp->pid, SIGCONT);
1733                         kill(tcp->pid, fatal_sig);
1734                 }
1735                 detach(tcp);
1736         }
1737         if (cflag)
1738                 call_summary(outf);
1739 }
1740
1741 static void
1742 interrupt(int sig)
1743 {
1744         interrupted = sig;
1745 }
1746
1747 static int
1748 trace(void)
1749 {
1750         struct rusage ru;
1751         struct rusage *rup = cflag ? &ru : NULL;
1752 # ifdef __WALL
1753         static int wait4_options = __WALL;
1754 # endif
1755
1756         while (nprocs != 0) {
1757                 int pid;
1758                 int wait_errno;
1759                 int status, sig;
1760                 int stopped;
1761                 struct tcb *tcp;
1762                 unsigned event;
1763
1764                 if (interrupted)
1765                         return 0;
1766                 if (interactive)
1767                         sigprocmask(SIG_SETMASK, &empty_set, NULL);
1768 # ifdef __WALL
1769                 pid = wait4(-1, &status, wait4_options, rup);
1770                 if (pid < 0 && (wait4_options & __WALL) && errno == EINVAL) {
1771                         /* this kernel does not support __WALL */
1772                         wait4_options &= ~__WALL;
1773                         pid = wait4(-1, &status, wait4_options, rup);
1774                 }
1775                 if (pid < 0 && !(wait4_options & __WALL) && errno == ECHILD) {
1776                         /* most likely a "cloned" process */
1777                         pid = wait4(-1, &status, __WCLONE, rup);
1778                         if (pid < 0) {
1779                                 perror_msg("wait4(__WCLONE) failed");
1780                         }
1781                 }
1782 # else
1783                 pid = wait4(-1, &status, 0, rup);
1784 # endif /* __WALL */
1785                 wait_errno = errno;
1786                 if (interactive)
1787                         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
1788
1789                 if (pid < 0) {
1790                         switch (wait_errno) {
1791                         case EINTR:
1792                                 continue;
1793                         case ECHILD:
1794                                 /*
1795                                  * We would like to verify this case
1796                                  * but sometimes a race in Solbourne's
1797                                  * version of SunOS sometimes reports
1798                                  * ECHILD before sending us SIGCHILD.
1799                                  */
1800                                 return 0;
1801                         default:
1802                                 errno = wait_errno;
1803                                 perror_msg("wait");
1804                                 return -1;
1805                         }
1806                 }
1807                 if (pid == popen_pid) {
1808                         if (WIFEXITED(status) || WIFSIGNALED(status))
1809                                 popen_pid = 0;
1810                         continue;
1811                 }
1812
1813                 event = ((unsigned)status >> 16);
1814                 if (debug_flag) {
1815                         char buf[sizeof("WIFEXITED,exitcode=%u") + sizeof(int)*3 /*paranoia:*/ + 16];
1816                         char evbuf[sizeof(",PTRACE_EVENT_?? (%u)") + sizeof(int)*3 /*paranoia:*/ + 16];
1817                         strcpy(buf, "???");
1818                         if (WIFSIGNALED(status))
1819 #ifdef WCOREDUMP
1820                                 sprintf(buf, "WIFSIGNALED,%ssig=%s",
1821                                                 WCOREDUMP(status) ? "core," : "",
1822                                                 signame(WTERMSIG(status)));
1823 #else
1824                                 sprintf(buf, "WIFSIGNALED,sig=%s",
1825                                                 signame(WTERMSIG(status)));
1826 #endif
1827                         if (WIFEXITED(status))
1828                                 sprintf(buf, "WIFEXITED,exitcode=%u", WEXITSTATUS(status));
1829                         if (WIFSTOPPED(status))
1830                                 sprintf(buf, "WIFSTOPPED,sig=%s", signame(WSTOPSIG(status)));
1831 #ifdef WIFCONTINUED
1832                         if (WIFCONTINUED(status))
1833                                 strcpy(buf, "WIFCONTINUED");
1834 #endif
1835                         evbuf[0] = '\0';
1836                         if (event != 0) {
1837                                 static const char *const event_names[] = {
1838                                         [PTRACE_EVENT_CLONE] = "CLONE",
1839                                         [PTRACE_EVENT_FORK]  = "FORK",
1840                                         [PTRACE_EVENT_VFORK] = "VFORK",
1841                                         [PTRACE_EVENT_VFORK_DONE] = "VFORK_DONE",
1842                                         [PTRACE_EVENT_EXEC]  = "EXEC",
1843                                         [PTRACE_EVENT_EXIT]  = "EXIT",
1844                                 };
1845                                 const char *e;
1846                                 if (event < ARRAY_SIZE(event_names))
1847                                         e = event_names[event];
1848                                 else {
1849                                         sprintf(buf, "?? (%u)", event);
1850                                         e = buf;
1851                                 }
1852                                 sprintf(evbuf, ",PTRACE_EVENT_%s", e);
1853                         }
1854                         fprintf(stderr, " [wait(0x%04x) = %u] %s%s\n", status, pid, buf, evbuf);
1855                 }
1856
1857                 /* Look up 'pid' in our table. */
1858                 tcp = pid2tcb(pid);
1859
1860                 /* Under Linux, execve changes pid to thread leader's pid,
1861                  * and we see this changed pid on EVENT_EXEC and later,
1862                  * execve sysexit. Leader "disappears" without exit
1863                  * notification. Let user know that, drop leader's tcb,
1864                  * and fix up pid in execve thread's tcb.
1865                  * Effectively, execve thread's tcb replaces leader's tcb.
1866                  *
1867                  * BTW, leader is 'stuck undead' (doesn't report WIFEXITED
1868                  * on exit syscall) in multithreaded programs exactly
1869                  * in order to handle this case.
1870                  *
1871                  * PTRACE_GETEVENTMSG returns old pid starting from Linux 3.0.
1872                  * On 2.6 and earlier, it can return garbage.
1873                  */
1874                 if (event == PTRACE_EVENT_EXEC && os_release >= KERNEL_VERSION(3,0,0)) {
1875                         long old_pid = 0;
1876                         if (ptrace(PTRACE_GETEVENTMSG, pid, NULL, (long) &old_pid) >= 0
1877                          && old_pid > 0
1878                          && old_pid != pid
1879                         ) {
1880                                 struct tcb *execve_thread = pid2tcb(old_pid);
1881                                 if (tcp) {
1882                                         outf = tcp->outf;
1883                                         curcol = tcp->curcol;
1884                                         if (execve_thread) {
1885                                                 if (execve_thread->curcol != 0) {
1886                                                         /*
1887                                                          * One case we are here is -ff:
1888                                                          * try "strace -oLOG -ff test/threaded_execve"
1889                                                          */
1890                                                         fprintf(execve_thread->outf, " <pid changed to %d ...>\n", pid);
1891                                                         execve_thread->curcol = 0;
1892                                                 }
1893                                                 /* swap output FILEs (needed for -ff) */
1894                                                 tcp->outf = execve_thread->outf;
1895                                                 tcp->curcol = execve_thread->curcol;
1896                                                 execve_thread->outf = outf;
1897                                                 execve_thread->curcol = curcol;
1898                                         }
1899                                         droptcb(tcp);
1900                                 }
1901                                 tcp = execve_thread;
1902                                 if (tcp) {
1903                                         tcp->pid = pid;
1904                                         tcp->flags |= TCB_REPRINT;
1905                                         if (!cflag) {
1906                                                 printleader(tcp);
1907                                                 tprintf("+++ superseded by execve in pid %lu +++\n", old_pid);
1908                                                 line_ended();
1909                                         }
1910                                 }
1911                         }
1912                 }
1913
1914                 if (event == PTRACE_EVENT_EXEC && detach_on_execve) {
1915                         if (!skip_startup_execve)
1916                                 detach(tcp);
1917                         /* This was initial execve for "strace PROG". Skip. */
1918                         skip_startup_execve = 0;
1919                 }
1920
1921                 if (tcp == NULL) {
1922                         if (followfork) {
1923                                 /* This is needed to go with the CLONE_PTRACE
1924                                    changes in process.c/util.c: we might see
1925                                    the child's initial trap before we see the
1926                                    parent return from the clone syscall.
1927                                    Leave the child suspended until the parent
1928                                    returns from its system call.  Only then
1929                                    will we have the association of parent and
1930                                    child so that we know how to do clearbpt
1931                                    in the child.  */
1932                                 tcp = alloctcb(pid);
1933                                 tcp->flags |= TCB_ATTACHED | TCB_STARTUP | post_attach_sigstop;
1934                                 if (!qflag)
1935                                         fprintf(stderr, "Process %d attached\n",
1936                                                 pid);
1937                         }
1938                         else
1939                                 /* This can happen if a clone call used
1940                                    CLONE_PTRACE itself.  */
1941                         {
1942                                 if (WIFSTOPPED(status))
1943                                         ptrace(PTRACE_CONT, pid, (char *) 0, 0);
1944                                 error_msg_and_die("Unknown pid: %u", pid);
1945                         }
1946                 }
1947
1948                 /* Set current output file */
1949                 outf = tcp->outf;
1950                 curcol = tcp->curcol;
1951
1952                 if (cflag) {
1953                         tv_sub(&tcp->dtime, &ru.ru_stime, &tcp->stime);
1954                         tcp->stime = ru.ru_stime;
1955                 }
1956
1957                 if (WIFSIGNALED(status)) {
1958                         if (pid == strace_child)
1959                                 exit_code = 0x100 | WTERMSIG(status);
1960                         if (cflag != CFLAG_ONLY_STATS
1961                             && (qual_flags[WTERMSIG(status)] & QUAL_SIGNAL)) {
1962                                 printleader(tcp);
1963 #ifdef WCOREDUMP
1964                                 tprintf("+++ killed by %s %s+++\n",
1965                                         signame(WTERMSIG(status)),
1966                                         WCOREDUMP(status) ? "(core dumped) " : "");
1967 #else
1968                                 tprintf("+++ killed by %s +++\n",
1969                                         signame(WTERMSIG(status)));
1970 #endif
1971                                 line_ended();
1972                         }
1973                         droptcb(tcp);
1974                         continue;
1975                 }
1976                 if (WIFEXITED(status)) {
1977                         if (pid == strace_child)
1978                                 exit_code = WEXITSTATUS(status);
1979                         if (!cflag /* && (qual_flags[WTERMSIG(status)] & QUAL_SIGNAL) */ ) {
1980                                 printleader(tcp);
1981                                 tprintf("+++ exited with %d +++\n", WEXITSTATUS(status));
1982                                 line_ended();
1983                         }
1984                         droptcb(tcp);
1985                         continue;
1986                 }
1987                 if (!WIFSTOPPED(status)) {
1988                         fprintf(stderr, "PANIC: pid %u not stopped\n", pid);
1989                         droptcb(tcp);
1990                         continue;
1991                 }
1992
1993                 /* Is this the very first time we see this tracee stopped? */
1994                 if (tcp->flags & TCB_STARTUP) {
1995                         if (debug_flag)
1996                                 fprintf(stderr, "pid %d has TCB_STARTUP, initializing it\n", tcp->pid);
1997                         tcp->flags &= ~TCB_STARTUP;
1998                         if (tcp->flags & TCB_BPTSET) {
1999                                 /*
2000                                  * One example is a breakpoint inherited from
2001                                  * parent through fork().
2002                                  */
2003                                 if (clearbpt(tcp) < 0) {
2004                                         /* Pretty fatal */
2005                                         droptcb(tcp);
2006                                         cleanup();
2007                                         return -1;
2008                                 }
2009                         }
2010                         if (ptrace_setoptions) {
2011                                 if (debug_flag)
2012                                         fprintf(stderr, "setting opts %x on pid %d\n", ptrace_setoptions, tcp->pid);
2013                                 if (ptrace(PTRACE_SETOPTIONS, tcp->pid, NULL, ptrace_setoptions) < 0) {
2014                                         if (errno != ESRCH) {
2015                                                 /* Should never happen, really */
2016                                                 perror_msg_and_die("PTRACE_SETOPTIONS");
2017                                         }
2018                                 }
2019                         }
2020                 }
2021
2022                 sig = WSTOPSIG(status);
2023
2024                 if (event != 0) {
2025                         /* Ptrace event */
2026 #ifdef USE_SEIZE
2027                         if (event == PTRACE_EVENT_STOP || event == PTRACE_EVENT_STOP1) {
2028                                 /*
2029                                  * PTRACE_INTERRUPT-stop or group-stop.
2030                                  * PTRACE_INTERRUPT-stop has sig == SIGTRAP here.
2031                                  */
2032                                 if (sig == SIGSTOP
2033                                  || sig == SIGTSTP
2034                                  || sig == SIGTTIN
2035                                  || sig == SIGTTOU
2036                                 ) {
2037                                         stopped = 1;
2038                                         goto show_stopsig;
2039                                 }
2040                         }
2041 #endif
2042                         goto restart_tracee_with_sig_0;
2043                 }
2044
2045                 /* Is this post-attach SIGSTOP?
2046                  * Interestingly, the process may stop
2047                  * with STOPSIG equal to some other signal
2048                  * than SIGSTOP if we happend to attach
2049                  * just before the process takes a signal.
2050                  */
2051                 if (sig == SIGSTOP && (tcp->flags & TCB_IGNORE_ONE_SIGSTOP)) {
2052                         if (debug_flag)
2053                                 fprintf(stderr, "ignored SIGSTOP on pid %d\n", tcp->pid);
2054                         tcp->flags &= ~TCB_IGNORE_ONE_SIGSTOP;
2055                         goto restart_tracee_with_sig_0;
2056                 }
2057
2058                 if (sig != syscall_trap_sig) {
2059                         siginfo_t si;
2060
2061                         /* Nonzero (true) if tracee is stopped by signal
2062                          * (as opposed to "tracee received signal").
2063                          */
2064                         stopped = (ptrace(PTRACE_GETSIGINFO, pid, 0, (long) &si) < 0);
2065 #ifdef USE_SEIZE
2066  show_stopsig:
2067 #endif
2068                         if (cflag != CFLAG_ONLY_STATS
2069                             && (qual_flags[sig] & QUAL_SIGNAL)) {
2070 #if defined(PT_CR_IPSR) && defined(PT_CR_IIP)
2071                                 long pc = 0;
2072                                 long psr = 0;
2073
2074                                 upeek(tcp, PT_CR_IPSR, &psr);
2075                                 upeek(tcp, PT_CR_IIP, &pc);
2076
2077 # define PSR_RI 41
2078                                 pc += (psr >> PSR_RI) & 0x3;
2079 # define PC_FORMAT_STR  " @ %lx"
2080 # define PC_FORMAT_ARG  , pc
2081 #else
2082 # define PC_FORMAT_STR  ""
2083 # define PC_FORMAT_ARG  /* nothing */
2084 #endif
2085                                 printleader(tcp);
2086                                 if (!stopped) {
2087                                         tprintf("--- %s ", signame(sig));
2088                                         printsiginfo(&si, verbose(tcp));
2089                                         tprintf(PC_FORMAT_STR " ---\n"
2090                                                 PC_FORMAT_ARG);
2091                                 } else
2092                                         tprintf("--- stopped by %s" PC_FORMAT_STR " ---\n",
2093                                                 signame(sig)
2094                                                 PC_FORMAT_ARG);
2095                                 line_ended();
2096                         }
2097
2098                         if (!stopped)
2099                                 /* It's signal-delivery-stop. Inject the signal */
2100                                 goto restart_tracee;
2101
2102                         /* It's group-stop */
2103 #ifdef USE_SEIZE
2104                         if (use_seize) {
2105                                 /*
2106                                  * This ends ptrace-stop, but does *not* end group-stop.
2107                                  * This makes stopping signals work properly on straced process
2108                                  * (that is, process really stops. It used to continue to run).
2109                                  */
2110                                 if (ptrace_restart(PTRACE_LISTEN, tcp, 0) < 0) {
2111                                         cleanup();
2112                                         return -1;
2113                                 }
2114                                 tcp->curcol = curcol;
2115                                 continue;
2116                         }
2117                         /* We don't have PTRACE_LISTEN support... */
2118 #endif
2119                         goto restart_tracee;
2120                 }
2121
2122                 /* We handled quick cases, we are permitted to interrupt now. */
2123                 if (interrupted)
2124                         return 0;
2125
2126                 /* This should be syscall entry or exit.
2127                  * (Or it still can be that pesky post-execve SIGTRAP!)
2128                  * Handle it.
2129                  */
2130                 if (trace_syscall(tcp) < 0 && !tcp->ptrace_errno) {
2131                         /* ptrace() failed in trace_syscall() with ESRCH.
2132                          * Likely a result of process disappearing mid-flight.
2133                          * Observed case: exit_group() terminating
2134                          * all processes in thread group.
2135                          * We assume that ptrace error was caused by process death.
2136                          * We used to detach(tcp) here, but since we no longer
2137                          * implement "detach before death" policy/hack,
2138                          * we can let this process to report its death to us
2139                          * normally, via WIFEXITED or WIFSIGNALED wait status.
2140                          */
2141                         tcp->curcol = curcol;
2142                         continue;
2143                 }
2144  restart_tracee_with_sig_0:
2145                 sig = 0;
2146  restart_tracee:
2147                 /* Remember current print column before continuing. */
2148                 tcp->curcol = curcol;
2149                 if (ptrace_restart(PTRACE_SYSCALL, tcp, sig) < 0) {
2150                         cleanup();
2151                         return -1;
2152                 }
2153         }
2154         return 0;
2155 }
2156
2157 int
2158 main(int argc, char *argv[])
2159 {
2160         init(argc, argv);
2161
2162         /* Run main tracing loop */
2163         if (trace() < 0)
2164                 return 1;
2165
2166         cleanup();
2167         fflush(NULL);
2168         if (exit_code > 0xff) {
2169                 /* Avoid potential core file clobbering.  */
2170                 struct rlimit rlim = {0, 0};
2171                 setrlimit(RLIMIT_CORE, &rlim);
2172
2173                 /* Child was killed by a signal, mimic that.  */
2174                 exit_code &= 0xff;
2175                 signal(exit_code, SIG_DFL);
2176                 raise(exit_code);
2177                 /* Paranoia - what if this signal is not fatal?
2178                    Exit with 128 + signo then.  */
2179                 exit_code += 128;
2180         }
2181
2182         return exit_code;
2183 }