Process internals: /proc, signals, strace and ptrace
You examine a process's memory map, file descriptors, signal masks and system calls live, and diagnose processes that hang, leak or hide.
Level 501 · 17 lessons · 15 practice labs
Lessons
Anatomy of a process
- /proc/PID in depth: status, maps, limits
- Memory maps and smaps: real memory use
- File descriptors and lsof
- Process states: R, S, D, Z, T and what they mean
- Short task: find what processes stuck in D state are waiting for
Signals and life cycle
- Signal delivery, masks and handlers
- fork, exec, wait and where zombies come from
- Sessions, process groups and the controlling terminal
- Resource limits: ulimit and prlimit
- Short task: fix a daemon that misbehaves when its parent dies
Tracing
- strace in depth: filters, timing and child processes
- Library calls with ltrace
- Attaching gdb to a running process and getting a backtrace
- ptrace scope and restricting tracing
- Short task: prove with strace what an unresponsive service is stuck on
Wrap-up
- Catching processes that try to hide, using /proc
- Capstone: diagnose and report on a leaking, a hung and a hiding process
Practice labs
- Read a process's memory map: From a running process's memory map tell apart stack, heap and loaded shared libraries and submit the number of libraries.
- Find a leak from the file descriptor table: On a process whose descriptor count keeps growing, determine through /proc which kind of file is not being closed.
- Trace fork and exec to untangle process creation: Trace how many processes a shell pipeline creates, which descriptors are inherited and how credentials change, and document it.
- Find which signals a process catches: Decode the blocked, ignored and caught signals of a process that will not stop from its status file.
- Show who adopts orphan processes: Observe who adopts children whose parent died and change the outcome by making a process a subreaper.
- Fix signal handling in a service that loses data on shutdown: Trace the signal flow of a service that leaves half-written files when stopped, and fix its handler and stop timeout.
- Find the file a program is looking for with strace: From the system calls find the path of the config file a silently exiting program tries and fails to open.
- Catch a slow system call by timing: Using call durations and the summary table, determine in which call an intermittently stalling program spends its time.
- Inspect a deadlocked process live with gdb: Attach to an unresponsive multi-threaded process, take backtraces of all threads and identify the two locks causing the deadlock.
- Read a running process's actual limits: Read the effective limits of a service failing with too many open files from /proc and write which one was exceeded.
- Decode a process's effective capabilities: Decode the capability sets held by a non-root process and remove the excess one from its unit.
- Solve a permission problem by tracing credential changes: Trace the real, effective and saved IDs of a privilege-dropping service to find why it cannot write a file, then fix it.
- Turn on core dump collection: Set the limit and core pattern so a crashing service leaves a dump, trigger a crash and list the dump.
- Find the crash point from a dump: Open a saved dump in the debugger and extract the name of the function where the crash happened from the backtrace.
- Prove the root cause of an intermittent crash: Compare three dumps of a service that crashes weekly, find the shared input condition and prepare a minimal case that reproduces it.
About this course
You examine a process's memory map, file descriptors, signal masks and system calls live, and diagnose processes that hang, leak or hide.
What you will learn
- Anatomy of a process
- Signals and life cycle
- Tracing
- Wrap-up
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.