Reputation: 385
I've been trying to sample ptrace events from C. The following is my code to get a file handle on perf:
pid_t pid;
uint64_t next_offset=0;
if(argc != 2) {
fprintf(stderr,"please provide PID");
exit(EXIT_FAILURE);
}
pid = atoi(argv[1]);
printf("attaching to %d\n", pid);
memset(&pe, 0, sizeof(struct perf_event_attr));
pe.type = PERF_TYPE_SOFTWARE;
pe.size = sizeof(struct perf_event_attr);
pe.sample_type = PERF_SAMPLE_CPU | PERF_SAMPLE_TID;
pe.config = PERF_COUNT_SW_CPU_CLOCK;
pe.disabled = 1;
pe.sample_freq = 99;
pe.freq = 1;
//pe.wakeup_events = 1;
fd = perf_event_open(&pe, pid, -1, -1, 0);
Right now, if I set the pid to be a foreign process, I am not receiving any events. Yet, when I set the pid to be 0, I can read events from within my own process. I found the following line in the man pages for perf_event_open
:
When pid is greater than zero, permission to perform this system call is governed by a ptrace access mode PTRACE_MODE_READ_REALCREDS check;
I would really appreciate some explanation of what this means.
PS: I've tried running the code as root AND my /proc/sys/kernel/perf_event_paranoid
is -1. Command line perf works.
Upvotes: 0
Views: 90