On Wed, Oct 27, 2010 at 2:07 PM, Shachar Shemesh <[email protected]>wrote:
> > For threads, there is a strange set of events taking place. Both for strace > and for fakeroot-ng, the clone system call gets modified. For both, the new > thread created has the same debugger as the parent. For strace, the debugger > runs "wait", receives the child's pid, and handles it accordingly. For > fakeroot-ng, "wait" never reports the child. > > Running strace on the debugger shows that the exact same ptrace commands > are sent. I will happily send them to anyone who wishes to have a look. > > How can two programs do the same thing on the same system, and yet get such > different results? > > Not that I am an expert in this (I wouldn't even say I am novice ;) just a simple many-years-strace-user...), I am really guessing here and may be saying complete nonsense :) ...But perhaprs it's related to the fact that in your implementation they (the tracer and the tracee) both run on different UIDs (with the tracing process trying to trace a process that runs by a different user [which btw is 'more powerful']) and that's sort of a security feature? -- Shimi
_______________________________________________ Linux-il mailing list [email protected] http://mailman.cs.huji.ac.il/mailman/listinfo/linux-il
