On 09/15/2014 10:06 AM, Richard W.M. Jones wrote:
It wasn't clear to me how tracer works for non-C programs.
https://github.com/FrostyX/tracer/commit/4abfc4ecbc6d1d4cd89b7162e1ba3f63088...
Which basicaly checkout output of `ps` and if there is e.g. python as executable, it will check for arguments and use those. But I agree that interpreted languages are problem, because they open the file, read it and close the handler. So there are no footsteps to track.
However there was some Red Hat only discussion recently about how to do this for Python programs, with minimal overhead. Below I'm just reproducing a technique (untested) that I think will work for Python.
It requires a small patch to the Python interpreter, and a similar patch to any other language interpreters (eg. Perl, Ruby).
Rich.
For each module (*.py or *.pyc) that it imports, have it mmap the first page of that file into its memory.
The mmap would be PROT_NONE because it's not actually used, and the associated file descriptor should be closed.
This will appear in /proc/PID/maps, with a "(deleted)" flag if the underlying file gets deleted (and hence the process needs restarting).
The cost should be almost nothing:
- 4K of virtual memory, no real memory
- an extra mmap syscall on import
- an extra segment in the kernel's VM AVL
Very nice. Is there some bugzilla RFE report for this? Or should I file it?