LD_AUDIT¶

This is just a brief and vague description of the LD_AUDIT feature. For more information look to rtld-audit(7) man done by Petr Baudis or study the glibc/latrace source code. Very brief explanation follows.

The libc dynamic linker audit feature allows to trace/audit program’s symbols/libraries. The feature is enabled by the LD_AUDIT environment variable. This variable must contain path to the audit shared library. This audit library needs to follow specific interface. The interface functions will be then called by the dynamic linker appropriatelly.

The audit library needs to export following symbols (the "la_PLTENTER" and "la_PLTEXIT" names are architecture dependent).

"la_activity"
"la_objsearch"
"la_objopen"
"la_preinit"
"la_symbind32"
"la_symbind64"
"la_PLTENTER"
"la_PLTEXIT"
"la_objclose"

+

As for the latrace package the audit shared library is called libltaudit.so.

OBJSEARCH¶

The objsearch LD_AUDIT interface provide means for changing traced program shared object names/locations. The -L option argument should have following form:

-L s1[,s2,...] where sN is src [=%~] dst

The src is the source pattern/name and dst is the destination name/pattern.

PIPE mode¶

The latrace can work in two modes. The first one native does does the output directly in the traced program process. The other one, pipe mode use the IPC fifo mechanism to send the data from the traced process to the latrace process. The latrace process is then responsible for the output. Using the pipe mode you loose the traced program standard output context with printed symbols.

By using the pipe mode, the latrace is not dependent on the trace program usage/manipulation of the standard output descriptor. Also the symbol statistics counts -c, -C options use the pipe mode to transfer symbol information to the latrace binary, and the latrace binary does the counts at the end.

CONFIG¶

The latrace config file allows user to define symbols as an classic C functions with arguments. Argument names will be display together with values as the latrace output. The more arguments are defined, the more performance and memory penalties should be expected.

The package is delivered with several config files for the most commonly used functions. List of the glibc header files used follows (the list mostly follows the ltrace header files list, and author is willing to update it according to the needs.

/usr/include/arpa/inet.h
/usr/include/ctype.h
/usr/include/stdlib.h
/usr/include/string.h
/usr/include/ctype.h
/usr/include/ncurses.h
/usr/include/stdio.h
/usr/include/dirent.h
/usr/include/unistd.h
/usr/include/libintl.h
/usr/include/dlfcn.h
/usr/include/fcntl.h
/usr/include/getopt.h
/usr/include/signal.h
/usr/include/sys/ioctl.h
/usr/include/sys/socket.h
/usr/include/netdb.h
/usr/include/pthread.h
/usr/include/sys/resource.h
/usr/include/sys/mman.h

+

The config file structure consists of /etc/latrace.conf file, which is the default one read by latrace. This config file includes other config files placed in the /etc/latrace.d directory. This directory contain all the config files for the above mentioned header files.

As already mentioned, the latrace config file syntax lightly follows the C language syntax. Following part describes the latrace config file language.

void
char    u_char
short   u_short
int     u_int
long    u_long
llong   u_llong  # (long long)
float   double

typedef base_type new_type;
typedef base_type * new_type;
typedef base_type ** new_type;

START::         struct NAME { STRUCT_DEF };
STRUCT_DEF::    DEF | EMPTY
DEF::           NAME NAME |


                NAME ´*´ NAME |


                struct NAME NAME |


                struct NAME ´*´ NAME
NAME::          [-0-9a-zA-Z_]+

START::         DEF ´(´ ARGS ´)´ ´;´
ARGS::          ARGS ´,´ DEF | DEF | EMPTY

START::         ENUM NAME ´{´ ENUM_DEF ´}´ ´;´
ENUM_DEF::      ENUM_DEF ´,´ ENUM_ELEM | ENUM_ELEM
ENUM_ELEM::     NAME ´=´ NAME | NAME

---[ cut here ]-----------------------------
enum krava {


        krava1 = 1,


        krava2,


        krava3 = 100
};
#include "krava.conf"
typedef u_int pid_t;
struct ex_st {


        pid_t   p;


        int     cnt;


        char   *name;
};
int f1(pid_t p, struct ex_st *k);
int f2(char* name, struct ex_st k, int k = krava);
struct ex_st* f3(pid_t *p, struct ex_st k);
---[ cut here ]-----------------------------