diff options
author | markj <markj@FreeBSD.org> | 2014-08-04 15:36:22 +0000 |
---|---|---|
committer | markj <markj@FreeBSD.org> | 2014-08-04 15:36:22 +0000 |
commit | 2fd28e23736da641dbe3990391f997fb55353b17 (patch) | |
tree | eb6788ffbddddf0e243de1acbb43ecdc0a774121 /sys/cddl/dev/dtrace | |
parent | bde3467611213433dffde86fe37fa1ba8c021b09 (diff) | |
download | FreeBSD-src-2fd28e23736da641dbe3990391f997fb55353b17.zip FreeBSD-src-2fd28e23736da641dbe3990391f997fb55353b17.tar.gz |
MFC r256571:
Add a function, memstr, which can be used to convert a buffer of
null-separated strings to a single string. This can be used to print the
full arguments of a process using execsnoop (from the DTrace toolkit) or
with the following one-liner:
dtrace -n 'syscall::execve:return {trace(curpsinfo->pr_psargs);}'
Note that this relies on the process arguments being cached via the struct
proc, which means that it will not work for argvs longer than
kern.ps_arg_cache_limit. However, the following rather non-portable
script can be used to extract any argv at exec time:
fbt::kern_execve:entry
{
printf("%s", memstr(args[1]->begin_argv, ' ',
args[1]->begin_envv - args[1]->begin_argv));
}
The debug.dtrace.memstr_max sysctl limits the maximum argument size to
memstr().
Diffstat (limited to 'sys/cddl/dev/dtrace')
-rw-r--r-- | sys/cddl/dev/dtrace/dtrace_sysctl.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/sys/cddl/dev/dtrace/dtrace_sysctl.c b/sys/cddl/dev/dtrace/dtrace_sysctl.c index 073de9f..a2a4d10 100644 --- a/sys/cddl/dev/dtrace/dtrace_sysctl.c +++ b/sys/cddl/dev/dtrace/dtrace_sysctl.c @@ -89,3 +89,6 @@ SYSCTL_LONG(_kern_dtrace, OID_AUTO, dof_maxsize, CTLFLAG_RW, SYSCTL_LONG(_kern_dtrace, OID_AUTO, helper_actions_max, CTLFLAG_RW, &dtrace_helper_actions_max, 0, "maximum number of allowed helper actions"); + +SYSCTL_INT(_kern_dtrace, OID_AUTO, memstr_max, CTLFLAG_RW, &dtrace_memstr_max, + 0, "largest allowed argument to memstr(), 0 indicates no limit"); |