Upcoming features for #tracexec

#Exec backtrace and jump to parent

In next release, the #TUI will support gathering the exec #backtrace of any exec event, which will greatly simply debugging experience.

The exec backtrace shows the history of a specific event and indicates any ancestor spawns or directly tears itself down and becomes the new process.

Jump to parent is a lighter alternative to backtrace, where you just press `U` to jump to the parent exec evt.

#Linux #eBPF #ptrace #execve

tracexec 0.11.0 released with new timestamp feature and O_CLOEXEC file descriptors are now hidden by default.

#eBPF #linux #ptrace #exec #execve #trace

https://github.com/kxxt/tracexec/releases/tag/v0.11.0

Release v0.11.0 · kxxt/tracexec

New Features tracexec now collects the timestamps of the events. It is currently hidden by default. To show the timestamps inline, use --timestamp option. To control the format of the inline times...

GitHub

@cks

Yes, you might find versions of getopt.c around the place that have an

if (argc < 1)

check. Not this one in the current source code for GCC, though:

https://github.com/gcc-mirror/gcc/blob/83ffe9cde7fe0b4deb0d1b54175fd9b19c38179c/libiberty/getopt.c#L581

#Unix #C #execve #POSIX

gcc/getopt.c at 83ffe9cde7fe0b4deb0d1b54175fd9b19c38179c · gcc-mirror/gcc

Contribute to gcc-mirror/gcc development by creating an account on GitHub.

GitHub

@cks

Psst!

The buggy test program that blocked the EINVAL fix in Linux still has the bug today, two years later.

https://git.kernel.org/pub/scm/fs/xfs/xfstests-dev.git/tree/src/vfs/vfstest.c#n503

Amusingly, the subordinate program is a copy of the same program, and it starts by calling getopt_long_only(), one of whose earliest actions is:

optind = 1; /* Don't scan ARGV[0], the program name. */

followed closely by:

if (optind != argc && !strcmp (argv[optind], "--"))

argc is 0 at this point.

#Unix #C #execve #POSIX

vfstest.c « vfs « src - xfs/xfstests-dev.git - XFSQA testsuite