Catching exec on Intel Linux

[Daniel Jacobowitz]

On Mon, Aug 26, 2002 at 08:21:40AM -0700, Datoda wrote:
> Hi,
> 
>    I use PTRACE_SYSCALL to trace system calls.
> Ususally, PTRACE_SYSCALL stops twice for each system
> call (once at the entry and the other time at the exit
> of the system call). But for execve system call,
> PTRACE_SYSCALL stops three times (once at the entry
> and twice at the exit, it seems to me). Is there an
> explanation for this anomaly? Thanks. 

(Use TRACESYSGOOD as I suggested earlier?  Or the kernel patches I
posted to linux-kernel?)

The first is at syscall entry; the second is at the actual exec event
and is not actually a result of PTRACE_SYSCALL; even if you're not
tracing syscalls you'll get a trap.  The third is presumably at syscall
exit when the program starts.

-- 
Daniel Jacobowitz
MontaVista Software                         Debian GNU/Linux Developer