truss and /sbin/init

[Jens Trzaska]

* Oliver Fromme <olli at lurza.secnetix.de> [2006-02-09 15:32]:
> Jens Trzaska <jt at barfoos.de> wrote:
>  > David Kirchner <dpk at dpk.net> [2006-02-08 16:53]:
>  > > The memory is apparently locked in core, according to the L flag for
>  > > 'ps'. This should probably be documented in the truss man page to
>  > > avoid confusion.
>  > 
>  > Does you or perhaps someone else know why init is locked in core? Its
>  > not the case in 4.x and I can't see why a regular userspace process
>  > is locked. 
> 
> It _is_ the case in 4.x:
> 
> $ uname -rs
> FreeBSD 4.11-STABLE
> $ ps -p 1
>   PID  TT  STAT      TIME COMMAND
>     1  ??  ILs    0:17.41 /sbin/init --

You are right. I just checked by 'ls /proc/1/mem' which is available
in 4.11. Its locked. But I am more or less able to use truss on init.
Not very successful but I am for example able to track signals.

	anastasia:~#truss -p 1
	SIGNAL 1
	SIGNAL 1
	SIGNAL 1
	-- CANNOT READ REGISTERS --
	-- CANNOT READ REGISTERS --
	-- CANNOT READ REGISTERS --
	-- CANNOT READ REGISTERS --
 
> As for the reason:  Well, init(8) is special.  Its existence
> is critical for the running system, so it cannot be paged
> out to swap space.

That makes sense. Thank you for the explaination.

Linux strace shows the user a bit more where the problem may be
located:

	pepper:/home/jt# strace -p 1
	attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted


jens