Re: Command line arguments on Linux

From: Mladen Gogala <gogala.mladen_at_gmail.com>
Date: Thu, 16 Dec 2021 13:32:06 -0500
Message-ID: <77ca79dd-f1ed-f83b-c8d1-5c90c1ebc0bf_at_gmail.com>

Is there a kernel structure which stores command line arguments in Linux?

 

task_struct has comm, which contains only the program name.

 

I’m aware of the following possibilities, but they are inconvenient for my purpose:

• Reading /proc/PID files
• Capturing the second parameter of execve, which is the pointer to the array where the parameters are stored.

 

I’m trying to enrich the exitsnoop.py BCC script.

 

There is a file /proc/cmdline: 

cat /proc/cmdline
BOOT_IMAGE=(hd0,gpt4)/boot/vmlinuz-5.15.7-200.fc35.x86_64 root=UUID=4f86ab79-7c07-4fdb-9153-407d69514f67 ro rd.driver.blacklist=nouveau modprobe.blacklist=nouveau nvidia-drm.modeset=0 selinux=0 iommu=pt nvme_core.default_ps_max_latency_us=5500 delayacct rhgb quiet

-- 
Mladen Gogala
Database Consultant
Tel: (347) 321-1217
https://dbwhisperer.wordpress.com

-- http://www.freelists.org/webpage/oracle-l Received on Thu Dec 16 2021 - 19:32:06 CET