An autrace that follows forks

John D. Ramsdell ramsdell at mitre.org
Thu Oct 12 11:40:21 UTC 2006


James Antill <james.antill at redhat.com> writes:

> So, personally, I'd just have something like:
> 
> #ifndef PTRACE_O_TRACEFORK
> # define PTRACE_O_TRACEFORK 0x00000002 /* from kernel-2.6.x */
> #endif
> 
> ...and assuming you handle the error return from PTRACE_SETOPTIONS, it
> should mostly just work on all relevant systems.

The file gdb/linux_nat.c shows that GDB uses this trick, and many
other useful ones.  Time to cut-and-paste.

John




More information about the Linux-audit mailing list