How to trace a program from its very beginning without running it as root

前端 未结 7 1556
我在风中等你
我在风中等你 2021-02-04 09:44

I\'m writing a tool that calls through to DTrace to trace the program that the user specifies.

If my tool uses dtrace -c to run the program as a subprocess of DTrace, no

7条回答
  •  生来不讨喜
    2021-02-04 10:07

    See my answer on related question "How can get dtrace to run the traced command with non-root priviledges?" [sic].

    Essentially, you can start a (non-root) background process which waits 1sec for DTrace to start up (sorry for race condition), and snoops the PID of that process.

    sudo true && \
    (sleep 1; cat /etc/hosts) &; \
    sudo dtrace -n 'syscall:::entry /pid == $1/ {@[probefunc] = count();}' $! \
    && kill $!
    

    Full explanation in linked answer.

提交回复
热议问题