Linux Process Control via the File System
چکیده
We report on the implementation of process control and inspection via the process file system on Linux. Our work extends the existing Linux process file system by adding four files that collectively give read-write access to a process’s address space and allow processes to be controlled and their state observed. Process control follows the model of control in recent versions of the Solaris operating system. The existing Linux process control mechanism, the ptrace system call, changes a process’s parent pointer to that of the attached tracing process. Our implementation subsumes ptrace and does not violate this critical data element. Further, this new controlling method allows multiple tracing processes, the ability to detach from a stopped process and leave it stopped, and the ability to trace a subset of system calls, signals, and hardware faults. We detail the four files added to the process file system and describe the control techniques. We examine the delays this enhanced file system adds to critical paths in the kernel, finding that selective system call tracing adds only one clock cycle to the common case of an untraced process. Performance gains are impressive, improving upon ptrace by 374% by allowing fine-grained system call tracing.