使用预加载库运行目标二进制文件，该库可以捕获 fork()。只要所有子进程也使用了该预加载库，您将看到所有本地子进程，无论如何执行。
这里是一个示例实现。
首先，是 forkmonitor.h 头文件。它定义了从预加载库传递到监视进程的消息：
#ifndef FORKMONITOR_H
#define FORKMONITOR_H
#define FORKMONITOR_ENVNAME "FORKMONITOR_SOCKET"
#ifndef UNIX_PATH_MAX
#define UNIX_PATH_MAX 108
#endif
#define TYPE_EXEC 1 /* When a binary is executed */
#define TYPE_DONE 2 /* exit() or return from main() */
#define TYPE_FORK 3
#define TYPE_VFORK 4
#define TYPE_EXIT 5 /* _exit() or _Exit() */
#define TYPE_ABORT 6 /* abort() */
struct message {
pid_t pid; /* Process ID */
pid_t ppid; /* Parent process ID */
pid_t sid; /* Session ID */
pid_t pgid; /* Process group ID */
uid_t uid; /* Real user ID */
gid_t gid; /* Real group ID */
uid_t euid; /* Effective user ID */
gid_t egid; /* Effective group ID */
unsigned short len; /* Length of data[] */
unsigned char type; /* One of the TYPE_ constants */
char data[0]; /* Optional payload, possibly longer */
};
#endif /* FORKMONITOR_H */
FORKMONITOR_SOCKET环境变量（由上面的FORKMONITOR_ENVNAME宏命名）指定了监视进程的Unix域数据报套接字地址。如果未定义或为空，则不发送监视消息。libforkmonitor.c。请注意，我简化了代码，省略了多线程初始化（因为很少有库调用任何拦截函数，更少的是从多个线程中调用它）。最好使用原子内置函数(__sync_bool_compare_and_swap())来更新函数指针，并使用原子getter ( __sync_fetch_and_or(,0))来检索函数指针，以避免任何与奇怪库有关的问题。（对于多线程程序来说，这是非常安全的，因为在执行main()之前只会修改指针。）#define _POSIX_C_SOURCE 200809L
#define _GNU_SOURCE
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/un.h>
#include <dlfcn.h>
#include <limits.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include "forkmonitor.h"
static pid_t (*actual_fork)(void) = NULL;
static pid_t (*actual_vfork)(void) = NULL;
static void (*actual_abort)(void) = NULL;
static void (*actual__exit)(int) = NULL;
static void (*actual__Exit)(int) = NULL;
static int commfd = -1;
#define MINIMUM_COMMFD 31
static void notify(const int type, struct message *const msg, const size_t extra)
{
const int saved_errno = errno;
msg->pid = getpid();
msg->ppid = getppid();
msg->sid = getsid(0);
msg->pgid = getpgrp();
msg->uid = getuid();
msg->gid = getgid();
msg->euid = geteuid();
msg->egid = getegid();
msg->len = extra;
msg->type = type;
/* Since we don't have any method of dealing with send() errors
* or partial send()s, we just fire one off and hope for the best. */
send(commfd, msg, sizeof (struct message) + extra, MSG_EOR | MSG_NOSIGNAL);
errno = saved_errno;
}
void libforkmonitor_init(void) __attribute__((constructor));
void libforkmonitor_init(void)
{
const int saved_errno = errno;
int result;
/* Save the actual fork() call pointer. */
if (!actual_fork)
*(void **)&actual_fork = dlsym(RTLD_NEXT, "fork");
/* Save the actual vfork() call pointer. */
if (!actual_vfork)
*(void **)&actual_vfork = dlsym(RTLD_NEXT, "vfork");
/* Save the actual abort() call pointer. */
if (!actual_abort)
*(void **)&actual_abort = dlsym(RTLD_NEXT, "abort");
/* Save the actual _exit() call pointer. */
if (!actual__exit)
*(void **)&actual__exit = dlsym(RTLD_NEXT, "_exit");
if (!actual__exit)
*(void **)&actual__exit = dlsym(RTLD_NEXT, "_Exit");
/* Save the actual abort() call pointer. */
if (!actual__Exit)
*(void **)&actual__Exit = dlsym(RTLD_NEXT, "_Exit");
if (!actual__Exit)
*(void **)&actual__Exit = dlsym(RTLD_NEXT, "_exit");
/* Open an Unix domain datagram socket to the observer. */
if (commfd == -1) {
const char *address;
/* Connect to where? */
address = getenv(FORKMONITOR_ENVNAME);
if (address && *address) {
struct sockaddr_un addr;
memset(&addr, 0, sizeof addr);
addr.sun_family = AF_UNIX;
strncpy(addr.sun_path, address, sizeof addr.sun_path - 1);
/* Create and bind the socket. */
commfd = socket(AF_UNIX, SOCK_DGRAM, 0);
if (commfd != -1) {
if (connect(commfd, (const struct sockaddr *)&addr, sizeof (addr)) == -1) {
/* Failed. Close the socket. */
do {
result = close(commfd);
} while (result == -1 && errno == EINTR);
commfd = -1;
}
}
/* Move commfd to a high descriptor, to avoid complications. */
if (commfd != -1 && commfd < MINIMUM_COMMFD) {
const int newfd = MINIMUM_COMMFD;
do {
result = dup2(commfd, newfd);
} while (result == -1 && errno == EINTR);
if (!result) {
do {
result = close(commfd);
} while (result == -1 && errno == EINTR);
commfd = newfd;
}
}
}
}
/* Send an init message, listing the executable path. */
if (commfd != -1) {
size_t len = 128;
struct message *msg = NULL;
while (1) {
ssize_t n;
free(msg);
msg = malloc(sizeof (struct message) + len);
if (!msg) {
len = 0;
break;
}
n = readlink("/proc/self/exe", msg->data, len);
if (n > (ssize_t)0 && (size_t)n < len) {
msg->data[n] = '\0';
len = n + 1;
break;
}
len = (3 * len) / 2;
if (len >= 65536U) {
free(msg);
msg = NULL;
len = 0;
break;
}
}
if (len > 0) {
/* INIT message with executable name */
notify(TYPE_EXEC, msg, len);
free(msg);
} else {
/* INIT message without executable name */
struct message msg2;
notify(TYPE_EXEC, &msg2, sizeof msg2);
}
}
/* Restore errno. */
errno = saved_errno;
}
void libforkmonitor_done(void) __attribute__((destructor));
void libforkmonitor_done(void)
{
const int saved_errno = errno;
int result;
/* Send an exit message, no data. */
if (commfd != -1) {
struct message msg;
notify(TYPE_DONE, &msg, sizeof msg);
}
/* If commfd is open, close it. */
if (commfd != -1) {
do {
result = close(commfd);
} while (result == -1 && errno == EINTR);
}
/* Restore errno. */
errno = saved_errno;
}
/*
* Hooked C library functions.
*/
pid_t fork(void)
{
pid_t result;
if (!actual_fork) {
const int saved_errno = errno;
*(void **)&actual_fork = dlsym(RTLD_NEXT, "fork");
if (!actual_fork) {
errno = EAGAIN;
return (pid_t)-1;
}
errno = saved_errno;
}
result = actual_fork();
if (!result && commfd != -1) {
struct message msg;
notify(TYPE_FORK, &msg, sizeof msg);
}
return result;
}
pid_t vfork(void)
{
pid_t result;
if (!actual_vfork) {
const int saved_errno = errno;
*(void **)&actual_vfork = dlsym(RTLD_NEXT, "vfork");
if (!actual_vfork) {
errno = EAGAIN;
return (pid_t)-1;
}
errno = saved_errno;
}
result = actual_vfork();
if (!result && commfd != -1) {
struct message msg;
notify(TYPE_VFORK, &msg, sizeof msg);
}
return result;
}
void _exit(const int code)
{
if (!actual__exit) {
const int saved_errno = errno;
*(void **)&actual__exit = dlsym(RTLD_NEXT, "_exit");
if (!actual__exit)
*(void **)&actual__exit = dlsym(RTLD_NEXT, "_Exit");
errno = saved_errno;
}
if (commfd != -1) {
struct {
struct message msg;
int extra;
} data;
memcpy(&data.msg.data[0], &code, sizeof code);
notify(TYPE_EXIT, &(data.msg), sizeof (struct message) + sizeof (int));
}
if (actual__exit)
actual__exit(code);
exit(code);
}
void _Exit(const int code)
{
if (!actual__Exit) {
const int saved_errno = errno;
*(void **)&actual__Exit = dlsym(RTLD_NEXT, "_Exit");
if (!actual__Exit)
*(void **)&actual__Exit = dlsym(RTLD_NEXT, "_exit");
errno = saved_errno;
}
if (commfd != -1) {
struct {
struct message msg;
int extra;
} data;
memcpy(&data.msg.data[0], &code, sizeof code);
notify(TYPE_EXIT, &(data.msg), sizeof (struct message) + sizeof (int));
}
if (actual__Exit)
actual__Exit(code);
exit(code);
}
void abort(void)
{
if (!actual_abort) {
const int saved_errno = errno;
*(void **)&actual_abort = dlsym(RTLD_NEXT, "abort");
errno = saved_errno;
}
if (commfd != -1) {
struct message msg;
notify(TYPE_ABORT, &msg, sizeof msg);
}
actual_abort();
exit(127);
}
libforkmonitor_init()函数在进程main()被调用之前由运行时链接器自动调用，而libforkmonitor_done()会在进程从main()返回或调用exit()时被调用。
libforkmonitor_init()打开了一个Unix域数据报套接字以连接监视进程，并发送其凭据和当前可执行文件的路径。每个子进程（只要预加载库仍在加载）在加载后都会执行此操作，因此根本不需要捕获exec*()或posix_spawn*()或'popen()`等函数。
C库函数fork()和vfork()被拦截。这些拦截是需要的，以捕获原始程序无需执行任何其他二进制文件即可创建从属进程的情况。（至少GNU C库在内部使用fork()，因此这些将捕获popen()，posix_spawn()等。）
此外，C库函数_exit()，_Exit()和abort()也被拦截。我添加了这些，因为一些二进制文件，尤其是Dash，喜欢使用_exit()，我认为捕获所有正常退出的形式会很好。（但是，不会检测由于信号而导致的死亡；如果二进制文件执行另一个二进制文件，则只会得到新的EXEC消息。请注意进程和父进程ID。）
这是一个简单的监视程序forkmonitor.c：
#define _POSIX_C_SOURCE 200809L
#include <unistd.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <signal.h>
#include <pwd.h>
#include <grp.h>
#include <string.h>
#include <stdio.h>
#include <errno.h>
#include "forkmonitor.h"
static volatile sig_atomic_t done = 0;
static void done_handler(const int signum)
{
if (!done)
done = signum;
}
static int catch_done(const int signum)
{
struct sigaction act;
sigemptyset(&act.sa_mask);
act.sa_handler = done_handler;
act.sa_flags = 0;
if (sigaction(signum, &act, NULL) == -1)
return errno;
return 0;
}
static const char *username(const uid_t uid)
{
static char buffer[128];
struct passwd *pw;
pw = getpwuid(uid);
if (!pw)
return NULL;
strncpy(buffer, pw->pw_name, sizeof buffer - 1);
buffer[sizeof buffer - 1] = '\0';
return (const char *)buffer;
}
static const char *groupname(const gid_t gid)
{
static char buffer[128];
struct group *gr;
gr = getgrgid(gid);
if (!gr)
return NULL;
strncpy(buffer, gr->gr_name, sizeof buffer - 1);
buffer[sizeof buffer - 1] = '\0';
return (const char *)buffer;
}
int main(int argc, char *argv[])
{
const size_t msglen = 65536;
struct message *msg;
int socketfd, result;
const char *user, *group;
if (catch_done(SIGINT) || catch_done(SIGQUIT) || catch_done(SIGHUP) ||
catch_done(SIGTERM) || catch_done(SIGPIPE)) {
fprintf(stderr, "Cannot set signal handlers: %s.\n", strerror(errno));
return 1;
}
if (argc != 2 || !strcmp(argv[1], "-h") || !strcmp(argv[1], "--help")) {
fprintf(stderr, "\n");
fprintf(stderr, "Usage: %s [ -h | --help ]\n", argv[0]);
fprintf(stderr, " %s MONITOR-SOCKET-PATH\n", argv[0]);
fprintf(stderr, "\n");
fprintf(stderr, "This program outputs events reported by libforkmonitor\n");
fprintf(stderr, "to Unix domain datagram sockets at MONITOR-SOCKET-PATH.\n");
fprintf(stderr, "\n");
return 0;
}
msg = malloc(msglen);
if (!msg) {
fprintf(stderr, "Out of memory.\n");
return 1;
}
socketfd = socket(AF_UNIX, SOCK_DGRAM, 0);
if (socketfd == -1) {
fprintf(stderr, "Cannot create an Unix domain datagram socket: %s.\n", strerror(errno));
return 1;
}
{
struct sockaddr_un addr;
size_t len;
if (argv[1])
len = strlen(argv[1]);
else
len = 0;
if (len < 1 || len >= UNIX_PATH_MAX) {
fprintf(stderr, "%s: Path is too long (max. %d characters)\n", argv[1], UNIX_PATH_MAX - 1);
return 1;
}
memset(&addr, 0, sizeof addr);
addr.sun_family = AF_UNIX;
memcpy(addr.sun_path, argv[1], len + 1); /* Include '\0' at end */
if (bind(socketfd, (struct sockaddr *)&addr, sizeof (addr)) == -1) {
fprintf(stderr, "Cannot bind to %s: %s.\n", argv[1], strerror(errno));
return 1;
}
}
printf("Waiting for connections.\n");
printf("\n");
/* Infinite loop. */
while (!done) {
ssize_t n;
n = recv(socketfd, msg, msglen, 0);
if (n == -1) {
const char *const errmsg = strerror(errno);
fprintf(stderr, "%s.\n", errmsg);
fflush(stderr);
break;
}
if (msglen < sizeof (struct message)) {
fprintf(stderr, "Received a partial message; discarded.\n");
fflush(stderr);
continue;
}
switch (msg->type) {
case TYPE_EXEC:
printf("Received an EXEC message:\n");
break;
case TYPE_DONE:
printf("Received a DONE message:\n");
break;
case TYPE_FORK:
printf("Received a FORK message:\n");
break;
case TYPE_VFORK:
printf("Received a VFORK message:\n");
break;
case TYPE_EXIT:
printf("Received an EXIT message:\n");
break;
case TYPE_ABORT:
printf("Received an ABORT message:\n");
break;
default:
printf("Received an UNKNOWN message:\n");
break;
}
if (msg->type == TYPE_EXEC && (size_t)n > sizeof (struct message)) {
if (*((char *)msg + n - 1) == '\0')
printf("\tExecutable: '%s'\n", (char *)msg + sizeof (struct message));
}
printf("\tProcess ID: %d\n", (int)msg->pid);
printf("\tParent process ID: %d\n", (int)msg->ppid);
printf("\tSession ID: %d\n", (int)msg->sid);
printf("\tProcess group ID: %d\n", (int)msg->pgid);
user = username(msg->uid);
if (user)
printf("\tReal user: '%s' (%d)\n", user, (int)msg->uid);
else
printf("\tReal user: %d\n", (int)msg->uid);
group = groupname(msg->gid);
if (group)
printf("\tReal group: '%s' (%d)\n", group, (int)msg->gid);
else
printf("\tReal group: %d\n", (int)msg->gid);
user = username(msg->euid);
if (user)
printf("\tEffective user: '%s' (%d)\n", user, (int)msg->euid);
else
printf("\tEffective user: %d\n", (int)msg->euid);
group = groupname(msg->egid);
if (group)
printf("\tEffective group: '%s' (%d)\n", group, (int)msg->egid);
else
printf("\tEffective group: %d\n", (int)msg->egid);
printf("\n");
fflush(stdout);
}
do {
result = close(socketfd);
} while (result == -1 && errno == EINTR);
unlink(argv[1]);
return 0;
}
这个命令需要一个命令行参数，即Unix域套接字地址。它应该是绝对的文件系统路径。
你可以通过INT (Ctrl+C)、HUP、QUIT和TERM信号停止监控程序。
使用以下命令编译库：
gcc -W -Wall -O3 -fpic -fPIC -c libforkmonitor.c
gcc -shared -Wl,-soname,libforkmonitor.so libforkmonitor.o -ldl -o libforkmonitor.so
并且监视程序使用
gcc -W -Wall -O3 forkmonitor.c -o forkmonitor
./forkmonitor "$PWD/commsocket"
libforkmonitor.so 库，并指定监视器的套接字：env "LD_PRELOAD=$PWD/libforkmonitor.so" "FORKMONITOR_SOCKET=$PWD/commsocket" command args...
LD_PRELOAD和FORKMONITOR_SOCKET环境变量，如果父进程修改环境变量（删除这两个环境变量）或者执行setuid或setgid二进制文件，则子进程将被忽略。为避免这种限制，可以消除环境变量并将它们硬编码。setuid或setgid二进制文件，运行时链接器不会预加载库，除非该库在标准库目录之一，并且标记为setgid。/etc/ld.so.preload中，将预加载库应用于所有二进制文件，但您可能应该将一个机制添加到libforkmonitor_init()中，以限制监视所需的二进制文件和/或指定的真实用户（因为在运行setuid二进制文件时有效用户会发生变化）。env "LD_PRELOAD=$PWD/libforkmonitor.so" "FORKMONITOR_SOCKET=$PWD/commsocket" sh -c 'date ; ls -laF'
监控输出为（匿名）：
Received an EXEC message:
Executable: 'bin/dash'
Process ID: 11403
Parent process ID: 9265
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received a FORK message:
Process ID: 11404
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received an EXEC message:
Executable: 'bin/date'
Process ID: 11404
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received a DONE message:
Process ID: 11404
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received a FORK message:
Process ID: 11405
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received an EXEC message:
Executable: 'bin/ls'
Process ID: 11405
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received a DONE message:
Process ID: 11405
Parent process ID: 11403
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
Received an EXIT message:
Process ID: 11403
Parent process ID: 9265
Session ID: 9265
Process group ID: 11403
Real user: 'username' (1000)
Real group: 'username' (1000)
Effective user: 'username' (1000)
Effective group: 'username' (1000)
fork()、vfork()、_exit()、_Exit()、abort()）之外，程序执行不会受到任何影响。由于该库非常轻巧，即使受影响的部分也只会受到极小的影响，可能无法可靠地测量。LD_PRELOAD和FORKMONITOR_SOCKET环境变量）有关的进程，但如果具有超级用户权限，则可以解决这些问题。fork、exec、exit或任何Unix信号接收。如果Linux提供了一种跟踪任何进程事件的系统调用，就像FreeBSD的kevent系统调用一样，那就太好了。所以，我认为在Linux上无法实现我想要的东西，除非我创建自己的系统调用。所以，无论如何，非常感谢您尽力帮助我，但我最多只能点赞您的回答 :( - LuisABOLsignal()和sigaction()等系统调用以使用自己的预处理程序来通知监视器，则可以监视信号接收。（如果您愿意，我可以展示如何做到这一点。） - Nominal Animalhttp://bewareofgeek.livejournal.com/2945.html
我刚在 Fedora 17 x86_64 上干净地编译了它，结果是这样的：
[root@hip1 yotest]# ./proc
set mcast listen ok
fork: parent tid=2358 pid=2358 -> child tid=21007 pid=21007
exec: tid=21007 pid=21007
fork: parent tid=21007 pid=21007 -> child tid=21008 pid=21008
fork: parent tid=21007 pid=21007 -> child tid=21009 pid=21009
fork: parent tid=21007 pid=21007 -> child tid=21010 pid=21010
fork: parent tid=21007 pid=21007 -> child tid=21011 pid=21011
exec: tid=21010 pid=21010
exec: tid=21008 pid=21008
exec: tid=21011 pid=21011
exec: tid=21009 pid=21009
exit: tid=21008 pid=21008 exit_code=0
fork: parent tid=21010 pid=21010 -> child tid=21012 pid=21012
exit: tid=21009 pid=21009 exit_code=0
exec: tid=21012 pid=21012
exit: tid=21012 pid=21012 exit_code=0
exit: tid=21010 pid=21010 exit_code=0
exit: tid=21011 pid=21011 exit_code=0
exit: tid=21007 pid=21007 exit_code=0
#include <sys/socket.h>
#include <linux/netlink.h>
#include <linux/connector.h>
#include <linux/cn_proc.h>
#include <signal.h>
#include <errno.h>
#include <stdbool.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
/*
* connect to netlink
* returns netlink socket, or -1 on error
*/
static int nl_connect()
{
int rc;
int nl_sock;
struct sockaddr_nl sa_nl;
nl_sock = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
if (nl_sock == -1) {
perror("socket");
return -1;
}
sa_nl.nl_family = AF_NETLINK;
sa_nl.nl_groups = CN_IDX_PROC;
sa_nl.nl_pid = getpid();
rc = bind(nl_sock, (struct sockaddr *)&sa_nl, sizeof(sa_nl));
if (rc == -1) {
perror("bind");
close(nl_sock);
return -1;
}
return nl_sock;
}
/*
* subscribe on proc events (process notifications)
*/
static int set_proc_ev_listen(int nl_sock, bool enable)
{
int rc;
struct __attribute__ ((aligned(NLMSG_ALIGNTO))) {
struct nlmsghdr nl_hdr;
struct __attribute__ ((__packed__)) {
struct cn_msg cn_msg;
enum proc_cn_mcast_op cn_mcast;
};
} nlcn_msg;
memset(&nlcn_msg, 0, sizeof(nlcn_msg));
nlcn_msg.nl_hdr.nlmsg_len = sizeof(nlcn_msg);
nlcn_msg.nl_hdr.nlmsg_pid = getpid();
nlcn_msg.nl_hdr.nlmsg_type = NLMSG_DONE;
nlcn_msg.cn_msg.id.idx = CN_IDX_PROC;
nlcn_msg.cn_msg.id.val = CN_VAL_PROC;
nlcn_msg.cn_msg.len = sizeof(enum proc_cn_mcast_op);
nlcn_msg.cn_mcast = enable ? PROC_CN_MCAST_LISTEN : PROC_CN_MCAST_IGNORE;
rc = send(nl_sock, &nlcn_msg, sizeof(nlcn_msg), 0);
if (rc == -1) {
perror("netlink send");
return -1;
}
return 0;
}
/*
* handle a single process event
*/
static volatile bool need_exit = false;
static int handle_proc_ev(int nl_sock)
{
int rc;
struct __attribute__ ((aligned(NLMSG_ALIGNTO))) {
struct nlmsghdr nl_hdr;
struct __attribute__ ((__packed__)) {
struct cn_msg cn_msg;
struct proc_event proc_ev;
};
} nlcn_msg;
while (!need_exit) {
rc = recv(nl_sock, &nlcn_msg, sizeof(nlcn_msg), 0);
if (rc == 0) {
/* shutdown? */
return 0;
} else if (rc == -1) {
if (errno == EINTR) continue;
perror("netlink recv");
return -1;
}
switch (nlcn_msg.proc_ev.what) {
case PROC_EVENT_NONE:
printf("set mcast listen ok\n");
break;
case PROC_EVENT_FORK:
printf("fork: parent tid=%d pid=%d -> child tid=%d pid=%d\n",
nlcn_msg.proc_ev.event_data.fork.parent_pid,
nlcn_msg.proc_ev.event_data.fork.parent_tgid,
nlcn_msg.proc_ev.event_data.fork.child_pid,
nlcn_msg.proc_ev.event_data.fork.child_tgid);
break;
case PROC_EVENT_EXEC:
printf("exec: tid=%d pid=%d\n",
nlcn_msg.proc_ev.event_data.exec.process_pid,
nlcn_msg.proc_ev.event_data.exec.process_tgid);
break;
case PROC_EVENT_UID:
printf("uid change: tid=%d pid=%d from %d to %d\n",
nlcn_msg.proc_ev.event_data.id.process_pid,
nlcn_msg.proc_ev.event_data.id.process_tgid,
nlcn_msg.proc_ev.event_data.id.r.ruid,
nlcn_msg.proc_ev.event_data.id.e.euid);
break;
case PROC_EVENT_GID:
printf("gid change: tid=%d pid=%d from %d to %d\n",
nlcn_msg.proc_ev.event_data.id.process_pid,
nlcn_msg.proc_ev.event_data.id.process_tgid,
nlcn_msg.proc_ev.event_data.id.r.rgid,
nlcn_msg.proc_ev.event_data.id.e.egid);
break;
case PROC_EVENT_EXIT:
printf("exit: tid=%d pid=%d exit_code=%d\n",
nlcn_msg.proc_ev.event_data.exit.process_pid,
nlcn_msg.proc_ev.event_data.exit.process_tgid,
nlcn_msg.proc_ev.event_data.exit.exit_code);
break;
default:
printf("unhandled proc event\n");
break;
}
}
return 0;
}
static void on_sigint(int unused)
{
need_exit = true;
}
int main(int argc, const char *argv[])
{
int nl_sock;
int rc = EXIT_SUCCESS;
signal(SIGINT, &on_sigint);
siginterrupt(SIGINT, true);
nl_sock = nl_connect();
if (nl_sock == -1)
exit(EXIT_FAILURE);
rc = set_proc_ev_listen(nl_sock, true);
if (rc == -1) {
rc = EXIT_FAILURE;
goto out;
}
rc = handle_proc_ev(nl_sock);
if (rc == -1) {
rc = EXIT_FAILURE;
goto out;
}
set_proc_ev_listen(nl_sock, false);
out:
close(nl_sock);
exit(rc);
}
(gcc -o proc proc.c)
关于netlink的一些信息：
摘录：http://www.linuxjournal.com/article/7356
Netlink是异步的，因为与任何其他套接字API一样，它提供了一个套接字队列来平滑消息的突发。发送netlink消息的系统调用将消息排入接收者的netlink队列，然后调用接收者的接收处理程序。接收者在接收处理程序的上下文中可以决定立即处理消息还是将消息留在队列中，并在不同的上下文中稍后处理它。与netlink不同，系统调用需要同步处理。因此，如果我们使用系统调用从用户空间传递消息到内核，那么处理该消息的时间长短可能会影响内核的调度粒度。
最近也有这个有趣的nltrace公告，您可能也会感兴趣！ http://lists.infradead.org/pipermail/libnl/2013-April/000993.html
netlink。但是，由于我正在构建一种库，我不能假设应用程序将以 root 用户身份运行。如果我尝试以普通用户身份运行上面的代码，则 bind 函数会失败。因此，不幸的是，我无法使用 netlink。 - LuisABOLhttps://perf.wiki.kernel.org/index.php/Main_Page
http://sourceware.org/systemtap/SystemTap_Beginners_Guide/index.html
strace命令这样的东西吗？那么可以看看ptrace系统调用。 - Some programmer dudestrace的东西。我会尝试使用ptrace。谢谢。 - LuisABOLptrace和waitpid似乎工作正常。但是，fork和exec情况似乎不可能，因为这些函数没有相应的信号，对吗？当进程调用fork或exec时，它会发送任何信号吗？ - LuisABOLPTRACE_O_TRACECLONE是什么？ - jxhexec、fork、exit、clone等函数时停止。它们会对我很有帮助！不过，难道没有比ptrace更少侵入性的方法吗？有没有一些不会影响被监视进程执行流程的方法（就像ptrace那样）？ - LuisABOLfork()、vfork()、abort()、_exit()、_Exit()、exit()以及从main()返回时增加了最小的工作量。 - Nominal Animal