<div dir="ltr"><div class="gmail_quote">On Wed, Oct 27, 2010 at 2:07 PM, Shachar Shemesh <span dir="ltr"><<a href="mailto:shachar@shemesh.biz">shachar@shemesh.biz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<br>
For threads, there is a strange set of events taking place. Both for strace and for fakeroot-ng, the clone system call gets modified. For both, the new thread created has the same debugger as the parent. For strace, the debugger runs "wait", receives the child's pid, and handles it accordingly. For fakeroot-ng, "wait" never reports the child.<br>
<br>
Running strace on the debugger shows that the exact same ptrace commands are sent. I will happily send them to anyone who wishes to have a look.<br>
<br>
How can two programs do the same thing on the same system, and yet get such different results?<br>
<br></blockquote><div> </div></div>Not that I am an expert in this (I wouldn't even say I am novice ;) just a simple many-years-strace-user...), I am really guessing here and may be saying complete nonsense :) <br><br>
...But perhaprs it's related to the fact that in your implementation they (the tracer and the tracee) both run on different UIDs (with the tracing process trying to trace a process that runs by a different user [which btw is 'more powerful']) and that's sort of a security feature?<br>
<br>-- Shimi<br></div>