Fix strace tracing of forked processes when attaching to a process with --pid

[Jon TURNEY]

At the moment, --trace-children (enabled by default) only works when the 
straced process is started by using strace with a command line.

This patch uses the undocumented NtSetInformationProcess(ProcessDebugFlags) 
call to make --trace-children work when attaching to a process with --pid

This patch removes the explicit DebugActiveProcess() on each child process: In 
my testing this was not needed when the process was created using 
CreateProcess() with the DEBUG_PROCESS flag, and failed error 87 when a 
process had been attached to with DebugActiveProcess() and then had the 
DEBUG_ONLY_THIS_PROCESS flag cleared.

In the alternative, the man page should be fixed to mention that tracing
child  processes is only possible when using a command line and not with --pid.

2011-09-12  Jon TURNEY  <jon.tur...@dronecode.org.uk>

        * strace.cc (attach_process): Try to turn off DEBUG_ONLY_THIS_PROCESS
        if attaching to a process with the forkdebug flag set.
        (handle_output_debug_string): Apparently we don't need to explicitly
        attach for debugging when a child process starts
        * Makefile.in (strace.exe): Link with ntdll

At the moment, --trace-children only works when using strace with a command 
line.
This makes --trace-children work when attaching to a process by --pid

Index: utils/strace.cc
===================================================================
--- utils/strace.cc.orig
+++ utils/strace.cc
@@ -27,6 +27,7 @@ details. */
 #include "path.h"
 #undef cygwin_internal
 #include "loadlib.h"
+#include "ddk/ntapi.h"
 
 /* we *know* we're being built with GCC */
 #define alloca __builtin_alloca
@@ -293,6 +294,9 @@ load_cygwin ()
   return 1;
 }
 
+#define DEBUG_PROCESS_DETACH_ON_EXIT    0x00000001
+#define DEBUG_PROCESS_ONLY_THIS_PROCESS 0x00000002
+
 static void
 attach_process (pid_t pid)
 {
@@ -303,6 +307,23 @@ attach_process (pid_t pid)
   if (!DebugActiveProcess (child_pid))
     error (0, "couldn't attach to pid %d for debugging", child_pid);
 
+  if (forkdebug)
+    {
+      HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, child_pid);
+
+      if (h)
+        {
+          /* Try to turn off DEBUG_ONLY_THIS_PROCESS so we can follow forks */
+          /* This is only supported on XP and later */
+          ULONG DebugFlags = DEBUG_PROCESS_DETACH_ON_EXIT;
+          NTSTATUS status = NtSetInformationProcess(h, ProcessDebugFlags, 
&DebugFlags, sizeof(DebugFlags));
+          if (status)
+            warn (0, "Could not clear DEBUG_ONLY_THIS_PROCESS (%x), will not 
trace child processes", status);
+
+          CloseHandle(h);
+        }
+    }
+
   return;
 }
 
@@ -467,9 +488,6 @@ handle_output_debug_string (DWORD id, LP
 
   if (special == _STRACE_CHILD_PID)
     {
-      if (!DebugActiveProcess (n))
-       error (0, "couldn't attach to subprocess %d for debugging, "
-              "windows error %d", n, GetLastError ());
       return;
     }
 
Index: utils/Makefile.in
===================================================================
--- utils/Makefile.in.orig
+++ utils/Makefile.in
@@ -78,6 +78,7 @@ cygcheck.exe: MINGW_LDFLAGS += -lntdll
 cygpath.exe: ALL_LDFLAGS += -lcygwin -lntdll
 cygpath.exe: CXXFLAGS += -fno-threadsafe-statics
 ps.exe: ALL_LDFLAGS += -lcygwin -lntdll
+strace.exe: MINGW_LDFLAGS += -lntdll
 
 ldd.exe: ALL_LDFLAGS += -lpsapi