CODEWITHSUNDEEP
processpipesystem-callsstrace
darksky
darksky

Reputation: 21019

Syscalls in strace

I called strace on some program A which forks two child programs: B and C.

In strace, I have the following syscalls:

 pipe[([3,4]) = 0
 pipe([5,6]) = 0
 fork(wc) = 7135
 fork (gnetcat) = 7136
 close(3) = 0
 close(5) = 0
 close(4) = 0
 close(6) = 0
 wait4(-1, NULL, 0, NULL) = 7136
 wait4(-1, NUKLL, 0, NULL) = 7135

I am trying to rewrite the program A in C. In that case, I really never really have to know what those file descriptors 3,4,5 and 6 stand for, do I? Is there a way to find out what they are? I know 3 is for stderr.

Upvotes: 0

Views: 1392

Answers (2)

EllexusTechSupport
EllexusTechSupport

Reputation: 21

You should try running strace again with the -f flag so that it follows forks. At the moment you can only see what your top-level process does, you can't see what your child processes do.

The top-level process creates two pipes. Pipes are used by programs to communicate with each other. The first pipe has the read end on fd 3 and the write end on fd 4. The second pipe has the read end on fd 5 and the write end on fd 6.

Since the top-level program closes all four fds after calling the two child programs, it looks like they are just used internally by the child programs (who both get copies of the fds). This is unusually becuase normally I would expect to see the parent process keep one en open in orfer to communicate with the child. It looks like your trace is missing some important information about what happened to the fds after each fork.

This is what I would expect to see if a progcess was opening pipes inorder to capture stdout from a child, for example:

parent_pid: pipe[3,4]
parent_pid: clone() = child_pid
parent_pid: close(4)
child_pid:  dup(4,1)
child_pid:  close(4)
child_pid:  close(3)
child_pid:  execve(some program)
child_pid:  write(1)
parent_pid: read(3)
parent_pid: wait(child_pid)
child_pid:  exit()

Upvotes: 1

Sec
Sec

Reputation: 7334

0 ist STDIN, 1 is STDOUT and 2 is STDERR. All higher numbers are up to the application. In this case I suspect they are used to capture stdout/stderr of the freshly forked programs. This would mean that "wc" probably runs with its stdout connected to fd 3 and stderr to fd 4, so the main application can could the output of wc.

Upvotes: 0

Related Questions