APM: Question: How to access command line before its parsed into @ARGV

Wayne Walker wwalker at bybent.com
Thu Aug 25 19:41:50 PDT 2005


Bill, and all APM folks,

The guys that wrote the original shells were very smart.  While perl can
probably solve Bill's problem, the shell can probably solve it in 5
lines.  (--noprofile is a bash/sh thing on linux; find the equivalent
thing in AIX's /bin/sh, I've no AIX box to check).

This should do everything you need:

mv miscreant miscreant.real
touch miscreant
chmod 755 miscreant
vim miscreant  (emacs might work, by why take chances??  :)
----------------------------------
#!/bin/sh --noprofile

# Store the environment for later perusal
env > /tmp/env.$$

# Read stdin and store it for later perusal
cat > /tmp/stdin.$$

# The "'s around $@ are critical (man sh, then search for \$\@ or $@
# according to what pager you are using
# run the real miscreant saving stdout and sterr
$0.real "$@" < /tmp/stdin.$$ > /tmp/stdout.$$ 2> /tmp/stderr.$$

# feed stdout and stderr to whatever called miscreant
cat /tmp/stdout.$$
cat /tmp/stderr.$$ 1>&2
----------------------------------

$@ will expand in a way that recreates quoting with functional exactness
(something that didn't have/need quotes will get quoted, but the shell
will rip them back off such that it will exactly mimic the original
calling).

This will only not work if there is a time sensitive issue with the
interleaving of stdout and stderr.  That is a rare situation, but I
have seen it.

Wayne

On Thu, Aug 25, 2005 at 03:23:59PM -0700, Bill Raty wrote:
> Folks,
> 
> In Linux one can access the pre-parsed command line given to
> exec, using CPAN module Proc::ProcessTable .   It seems to
> reflect the assertions that quotes are removed by the shell
> before being given to exec.
> 
> =for example
> 
> use strict;
> use warnings;
> use Proc::ProcessTable;
> 
> my $proc_table = Proc::ProcessTable->new();
> my ($process) = grep $_->{pid} == $$, @{ $proc_table->table()
> };
> my $cmndline = $process->{cmndline};
> print "Command line for pid=$$: ($cmndline)\n";
> 
> =cut
> 
> The underlying problem is I need to gather forensics on an
> executable running on AIX that hangs intermittently.  The idea
> was to put a command proxy in its place (perl) that captures
> invocation arguments, STDIN, invokes the miscreant, and logs
> its STDOUT, STDERR and other vitals for later analysis. 
> Hopefully I'll be able to gather information for logging a
> support ticket with the producer of the executable.
> 
> Presumably the quotes I supply to this program don't reach it,
> and I can apply the cmndline from above to an 'exec', 'open',
> or 'open3'.
> 
> 
> 
> -Bill
> Reintarnation: Coming back to life as a hillbilly
> 
> _______________________________________________
> Austin mailing list
> Austin at pm.org
> http://mail.pm.org/mailman/listinfo/austin

-- 

Wayne Walker

wwalker at bybent.com                    Do you use Linux?!
http://www.bybent.com                 Get Counted!  http://counter.li.org/
Perl - http://www.perl.org/           Perl User Groups - http://www.pm.org/
Jabber:  wwalker at jabber.gnumber.com   AIM:     lwwalkerbybent
IRC:     wwalker on freenode.net


More information about the Austin mailing list