diff options
author | gnn <gnn@FreeBSD.org> | 2014-07-31 23:19:01 +0000 |
---|---|---|
committer | gnn <gnn@FreeBSD.org> | 2014-07-31 23:19:01 +0000 |
commit | 37b25c29bfd52a1cdd190bd39514786ebc8da152 (patch) | |
tree | 74c51764bc41f2d5ff2b2a176e752c67cb0a5c94 /cddl/contrib | |
parent | 6ed32776ca0f25e05c6f78abf9a460a43dff1436 (diff) | |
download | FreeBSD-src-37b25c29bfd52a1cdd190bd39514786ebc8da152.zip FreeBSD-src-37b25c29bfd52a1cdd190bd39514786ebc8da152.tar.gz |
Update shellsnoop to work on FreeBSD.
Contributed by: skreuzer
Diffstat (limited to 'cddl/contrib')
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Apps/shellsnoop | 14 |
1 files changed, 5 insertions, 9 deletions
diff --git a/cddl/contrib/dtracetoolkit/Apps/shellsnoop b/cddl/contrib/dtracetoolkit/Apps/shellsnoop index 95f42c0..69ff379 100755 --- a/cddl/contrib/dtracetoolkit/Apps/shellsnoop +++ b/cddl/contrib/dtracetoolkit/Apps/shellsnoop @@ -1,4 +1,4 @@ -#!/usr/bin/sh +#!/bin/sh # # shellsnoop - A program to print read/write details from shells, # such as keystrokes and command outputs. @@ -140,18 +140,14 @@ dtrace -n ' /* * Remember this PID is a shell child */ - syscall::exec:entry, syscall::exece:entry + syscall::execve:entry /execname == "sh" || execname == "ksh" || execname == "csh" || execname == "tcsh" || execname == "zsh" || execname == "bash"/ { child[pid] = 1; - /* debug */ - this->parent = (char *)curthread->t_procp->p_parent->p_user.u_comm; - OPT_debug == 1 ? printf("PID %d CMD %s started. (%s)\n", - pid, execname, stringof(this->parent)) : 1; } - syscall::exec:entry, syscall::exece:entry + syscall::execve:entry /(OPT_pid == 1 && PID != ppid) || (OPT_uid == 1 && UID != uid)/ { /* forget if filtered */ @@ -256,12 +252,12 @@ dtrace -n ' /* * Cleanup */ - syscall::rexit:entry + syscall::exit:entry { child[pid] = 0; /* debug */ - this->parent = (char *)curthread->t_procp->p_parent->p_user.u_comm; + this->parent = (char *)curthread->td_proc->p_pptr->p_comm; OPT_debug == 1 ? printf("PID %d CMD %s exited. (%s)\n", pid, execname, stringof(this->parent)) : 1; } |