Fix strace tracing of forked processes when attaching to a process with --pid

Fix strace tracing of forked processes when attaching to a process with --pid

[Jon TURNEY]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]


At the moment, --trace-children (enabled by default) only works when the 
straced process is started by using strace with a command line.

This patch uses the undocumented NtSetInformationProcess(ProcessDebugFlags) 
call to make --trace-children work when attaching to a process with --pid

This patch removes the explicit DebugActiveProcess() on each child process: In 
my testing this was not needed when the process was created using 
CreateProcess() with the DEBUG_PROCESS flag, and failed error 87 when a 
process had been attached to with DebugActiveProcess() and then had the 
DEBUG_ONLY_THIS_PROCESS flag cleared.

In the alternative, the man page should be fixed to mention that tracing
child  processes is only possible when using a command line and not with --pid.

2011-09-12  Jon TURNEY  <jon.turney@dronecode.org.uk>

	* strace.cc (attach_process): Try to turn off DEBUG_ONLY_THIS_PROCESS
	if attaching to a process with the forkdebug flag set.
	(handle_output_debug_string): Apparently we don't need to explicitly
	attach for debugging when a child process starts
	* Makefile.in (strace.exe): Link with ntdll


[-- Attachment #2: strace_follow_pid.patch --]
[-- Type: text/plain, Size: 2167 bytes --]

At the moment, --trace-children only works when using strace with a command line.
This makes --trace-children work when attaching to a process by --pid

Index: utils/strace.cc
===================================================================
--- utils/strace.cc.orig
+++ utils/strace.cc
@@ -27,6 +27,7 @@ details. */
 #include "path.h"
 #undef cygwin_internal
 #include "loadlib.h"
+#include "ddk/ntapi.h"
 
 /* we *know* we're being built with GCC */
 #define alloca __builtin_alloca
@@ -293,6 +294,9 @@ load_cygwin ()
   return 1;
 }
 
+#define DEBUG_PROCESS_DETACH_ON_EXIT    0x00000001
+#define DEBUG_PROCESS_ONLY_THIS_PROCESS 0x00000002
+
 static void
 attach_process (pid_t pid)
 {
@@ -303,6 +307,23 @@ attach_process (pid_t pid)
   if (!DebugActiveProcess (child_pid))
     error (0, "couldn't attach to pid %d for debugging", child_pid);
 
+  if (forkdebug)
+    {
+      HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, FALSE, child_pid);
+
+      if (h)
+        {
+          /* Try to turn off DEBUG_ONLY_THIS_PROCESS so we can follow forks */
+          /* This is only supported on XP and later */
+          ULONG DebugFlags = DEBUG_PROCESS_DETACH_ON_EXIT;
+          NTSTATUS status = NtSetInformationProcess(h, ProcessDebugFlags, &DebugFlags, sizeof(DebugFlags));
+          if (status)
+            warn (0, "Could not clear DEBUG_ONLY_THIS_PROCESS (%x), will not trace child processes", status);
+
+          CloseHandle(h);
+        }
+    }
+
   return;
 }
 
@@ -467,9 +488,6 @@ handle_output_debug_string (DWORD id, LP
 
   if (special == _STRACE_CHILD_PID)
     {
-      if (!DebugActiveProcess (n))
-	error (0, "couldn't attach to subprocess %d for debugging, "
-	       "windows error %d", n, GetLastError ());
       return;
     }
 
Index: utils/Makefile.in
===================================================================
--- utils/Makefile.in.orig
+++ utils/Makefile.in
@@ -78,6 +78,7 @@ cygcheck.exe: MINGW_LDFLAGS += -lntdll
 cygpath.exe: ALL_LDFLAGS += -lcygwin -lntdll
 cygpath.exe: CXXFLAGS += -fno-threadsafe-statics
 ps.exe: ALL_LDFLAGS += -lcygwin -lntdll
+strace.exe: MINGW_LDFLAGS += -lntdll
 
 ldd.exe: ALL_LDFLAGS += -lpsapi
 

Re: Fix strace tracing of forked processes when attaching to a process with --pid

[Christopher Faylor]

On Tue, Sep 13, 2011 at 01:04:55PM +0100, Jon TURNEY wrote:
>
>At the moment, --trace-children (enabled by default) only works when the 
>straced process is started by using strace with a command line.
>
>This patch uses the undocumented NtSetInformationProcess(ProcessDebugFlags) 
>call to make --trace-children work when attaching to a process with --pid
>
>This patch removes the explicit DebugActiveProcess() on each child process: In 
>my testing this was not needed when the process was created using 
>CreateProcess() with the DEBUG_PROCESS flag, and failed error 87 when a 
>process had been attached to with DebugActiveProcess() and then had the 
>DEBUG_ONLY_THIS_PROCESS flag cleared.
>
>In the alternative, the man page should be fixed to mention that tracing
>child  processes is only possible when using a command line and not with --pid.
>
>2011-09-12  Jon TURNEY  <jon.turney@dronecode.org.uk>
>
>	* strace.cc (attach_process): Try to turn off DEBUG_ONLY_THIS_PROCESS
>	if attaching to a process with the forkdebug flag set.
>	(handle_output_debug_string): Apparently we don't need to explicitly
>	attach for debugging when a child process starts
>	* Makefile.in (strace.exe): Link with ntdll
>

Looks good.  Please check in.

Thanks.

cgf