Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm implementing a ptrace based tool for logging system call use. It is much more simple than strace, but I'm doing this so I can learn how these tools work. I'd like to trace all user processes since they're created. Can it be achieved with ptrace?

share|improve this question
up vote 0 down vote accepted

New processes are created with system calls, namely fork(), vfork() and clone(). These days, the C functions corresponding to these calls are implemented with an underlying call to clone() (the actual system call, as seen from the kernel), but the two other system calls are still there and could be invoked by any process with a simple bit of assembly.

To trace all user processes, you just have to use ptrace(), and intercept these calls, so that you can attach to new processes immediately after their creation. That's how strace works.

share|improve this answer
I want to use this to log all users processes created after login. Using this approach, which process that I can ptrace, is parent of all other processes? So that I can automatically trace every process created. – Lehrling Apr 1 '13 at 15:25
The first process launched at boot time is /sbin/init and all other processes are descendent of that one. Things can become a bit complex if your Linux distribution uses an initrd or initramfs. You might prefer to trace the processes from a specific user, rather than all processes. Since there is high potential for making your system unbootable, I recommend that you try your code first in a virtual machine. – Thomas Pornin Apr 1 '13 at 16:05
I was too much restrictive when I said to log every process. I don't want to trace root processes, but other processes that user may invoke after login (again, except root). In this case, does init still be the only parent of user processes? Is there other parent that could be used? – Lehrling Apr 1 '13 at 18:56
Thomas, you're right, I would need to trace init, as the majority of users processes are created by init(confirmed that on ps output). I'll try your suggestion. – Lehrling Apr 2 '13 at 18:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.