Last system call from a process in bash

Question

I need to obtain the last system call from a process in a bash script only if I have permission to read. I'm doing this:

# $pid is the pid from the process
cat /proc/$pid/syscall

But when I do this, I get this message:

cat: /proc/21/syscall: Permission denied

or this one:

cat: /proc/2101/syscall: Operation not permitted

is this right? obviously permissions denied means i can't read it. But what does "Operation not permitted" mean?

And from one process, I get this line:

0 0x3 0x717000 0x10000 0x7ffca5422b00 0x0 0x79 0x7ffca5422c50 0x7f840be43810

Which one is the last system call?

Answer 1

About Operation not permitted, it is because you have read access to the file (the process is owned by you), but the kernel prohibits you to do so.

If you run dmesg after that error appears, you will see the following line:

ptrace of pid 12304 was attempted by: cat (pid 12342)

That is because the kernel avoids tracing a process that is not a child of the current one. This is controlled via the kernel.yama.ptrace_scope configuration option. If you do

cat /proc/sys/kernel/yama/ptrace_scope

it will have a value of 1.

More info: https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace

Answer 2

What about using strace:

$ strace -o /tmp/out command args; tail -n 2 /tmp/out
exit_group(0)                           = ?
+++ exited with 0 +++