autrace
I've been successfully using the audit package to trace programs that
fork by using the ptrace system call to add audit rules. As a result
of tracing ever more programs, I notice I have added three features to
my program that may be of use in the autrace program.
To trace a program that behaves like a server, I exercise the server,
and then send it a keyboard interrupt. If nothing special is done,
the tracing process terminates, but not the traced processes. To
handle this situation, I make the first child a process group leader
with:
if (setpgid(0, 0)) { /* Make child a process group leader */
perror("setpgid of child"); /* so that signals can be sent to */
return -1; /* the group */
}
The tracing process stores the pid of the first child in the group
variable, and then registers the following handler with SIGINT:
static void
signal_group(int signum)
{
if (group && kill(-group, signum))
perror("kill group");
if (signal(signum, SIG_DFL) == SIG_ERR)
fprintf(stderr, "Setting signal %d to its default failed\n", signum);
}
The group variable is set to zero whenever it is known no child is
running, such as when rules are being deleted.
For some of the programs I trace, it is important they not be run as
root. I have a -u username option, and before the first child
executes the traced program, I use the following code to make use of
the option's value.
static int
set_id(const char *username) /* Sets the group and user ID */
{ /* when given a user name. */
struct passwd *pent; /* Setuid and setgid bits are */
if (!username) /* ignored on the executable file */
return 0; /* containing the program being */
else if ((pent = getpwnam(username)) == NULL) { /* traced. */
fprintf(stderr, "Cannot find user `%s'\n", username);
return -1;
}
else if (setregid(pent->pw_gid, pent->pw_gid)) {
perror("setregid");
return -1;
}
else if (setreuid(pent->pw_uid, pent->pw_uid)) {
perror("setreuid");
return -1;
}
else
return 0;
}
Finally, when printing the command to retrieve the records associated
with the trace for process P, I would print
ausearch -i -p P > P.txt
rather than
'ausearch -i -p P'
I almost always want to place the output into a file, and when I
don't, it's easy to copy only part of the command. Also, the single
quotes force one to be more precise with the mouse than I like to be
when cutting and pasting within a terminal window.
If any or all of these suggestions seem useful, I am willing to
implement them in the autrace source file and send patches. On the
other hand, I tried to put enough detail into this message so you can
easily make the changes.
John