システムコールをstraceで確認する

• straceはLinuxのシステムコールをトレースできるコマンド

Linux環境を用意する

ちなみにDockerで起動するときは、--security-opt seccomp:unconfinedがないとstrace実行時に怒られる。

docker run -it --name php-strace --security-opt seccomp:unconfined php bash

Ubuntuでのインストール

apt-get update
apt-get install strace

straceのバージョン

strace -V
strace -- version 4.15

straceの使い方

strace {コマンド}

例:

# strace touch file
execve("/usr/bin/touch", ["touch", "file"], [/* 18 vars */]) = 0
brk(NULL)                               = 0x55fa6ed51000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf2ff1f000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=13994, ...}) = 0
mmap(NULL, 13994, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fdf2ff1b000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\4\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1689360, ...}) = 0
mmap(NULL, 3795296, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fdf2f960000
mprotect(0x7fdf2faf5000, 2097152, PROT_NONE) = 0
mmap(0x7fdf2fcf5000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x195000) = 0x7fdf2fcf5000
mmap(0x7fdf2fcfb000, 14688, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fdf2fcfb000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fdf2ff19000
arch_prctl(ARCH_SET_FS, 0x7fdf2ff19700) = 0
mprotect(0x7fdf2fcf5000, 16384, PROT_READ) = 0
mprotect(0x55fa6d993000, 4096, PROT_READ) = 0
mprotect(0x7fdf2ff22000, 4096, PROT_READ) = 0
munmap(0x7fdf2ff1b000, 13994)           = 0
brk(NULL)                               = 0x55fa6ed51000
brk(0x55fa6ed72000)                     = 0x55fa6ed72000
open("file", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = 3
dup2(3, 0)                              = 0
close(3)                                = 0
utimensat(0, NULL, NULL, 0)             = 0
close(0)                                = 0
close(1)                                = 0
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++