Re: kern/43611: kernel-trace (via ktruss) reports wrong parameter/result values

[David Laight <david%l8s.co.uk@localhost>]

The following reply was made to PR kern/43611; it has been noted by GNATS.

From: David Laight <david%l8s.co.uk@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: kern/43611: kernel-trace (via ktruss) reports wrong 
parameter/result values
Date: Wed, 14 Jul 2010 22:18:51 +0100

 On Wed, Jul 14, 2010 at 12:40:03PM +0000, Christos Zoulas wrote:
 >  On Jul 14,  1:50am, dholland-bugs%netbsd.org@localhost (David Holland) 
 > wrote:
 >  |  On Tue, Jul 13, 2010 at 05:40:04PM +0000, David Laight wrote:
 >  |   >  ktruss probably should be rewritten to use system call entry/exit
 >  |   >  breakpoints and then userspace controlled reads of the traced 
 > programs
 >  |   >  memory (which is how truss works on SYSV).
 >  |  
 >  |  Using ptrace for this purpose is not desirable because it monkeys with
 >  |  the parent/child process relationships and tends to break things,
 >  |  particularly shell scripts.
 >  
 >  It is desirable because it stops the process and lets you examine the
 >  syscall arguments in detail.
 
 Actually the systrace code would have let you do this, except that
 someone decided to use to try to implement security not tracing.
 IIRC that didn't mess with lineage of processes.
 
        David
 
 -- 
 David Laight: david%l8s.co.uk@localhost