Re: debugging/tracing a setuid program

[Emmanuel Dreyfus <manu%netbsd.org@localhost>]

On Fri, May 05, 2023 at 08:29:41PM +0200, Edgar Fuß wrote:
> > (a) I'd say it shouldn't stop ktracing
> I suspect it stops as soon as sudo calls setuid.

I have been using it for years like Der Mouse suggested:

$ su
# ktrace -di su -l manu
$ sudo apachectl graceful

The full trace is recorded:
 28256      1 sudo     CALL  setuid(0)
 28256      1 sudo     RET   setuid 0
 28256      1 sudo     CALL  setreuid(0xffffffff,0)
 28256      1 sudo     RET   setreuid 0
 28256      1 sudo     CALL  setregid(0xffffffff,0xffffffff)
 28256      1 sudo     RET   setregid 0
 28256      1 sudo     CALL  mmap(0,0x6000,PROT_READ|PROT_WRITE,0x1002<PRIVATE,A
NONYMOUS,ALIGN=NONE>,0xffffffff,0,0,0)
 28256      1 sudo     RET   mmap -1163366400/0xbaa87000
 28256      1 sudo     CALL  ioctl(8,TIOCGETA,0xbf7fced0)


-- 
Emmanuel Dreyfus
manu%netbsd.org@localhost