|The forkstat mascot|
- STAT_PTRC - ptrace attach/detach events
- STAT_UID - UID (and GID) change events
- STAT_SID - SID change events
The following example shows fortstat being used to detect when a process is being traced using ptrace:
sudo ./forkstat -x -e ptrce Time Event PID UID TTY Info Duration Process 11:42:31 ptrce 17376 0 pts/15 attach strace -p 17350 11:42:31 ptrce 17350 1000 pts/13 attach top 11:42:37 ptrce 17350 1000 pts/13 detach
Process 17376 runs strace on process 17350 (top). We can see the ptrace attach event on the process and also then a few seconds later the detach event. We can see that the strace was being run from pts/15 by root. Using forkstat we can now snoop on users who are snooping on other user's processes.
I use forkstat mainly to capture busy process fork/exec/exit activity that tools such as ps and top cannot see because of the very sort duration of some processes or threads. Sometimes processes are created rapidly that one needs to run forkstat with a high priority to capture all the events, and so the new -r option will run forkstat with a high real time scheduling priority to try and capture all the events.
These new features landed in forkstat V0.02.00 for Ubuntu 17.10 Aardvark.