Module procs 

Per-process bookkeeping shared by every handler: the program a process runs, the identity it believes it has under -0 and, without ptrace, the working directory it believes it is in.

With ptrace the tracer registers every child at its fork event and forgets it at exit. Without ptrace (see launch) nothing announces a new process, so the table is lazy: a process is discovered at its first notification and inherits the state of its parent, read from /proc. To make that inheritance exact when the parent changed state between the fork and the child’s first syscall, clone is notified too and a snapshot of the parent is queued for the child; a parent that exits first leaves its snapshots on an orphan list. Exits are observed through pidfds by a reaper thread so the table does not grow without bound.

Notifications carry thread ids; the thread-to-process map is cached and re-read from /proc once a second, which keeps a reused id from naming the wrong process for longer than that.

Structs

Ids

The identity a process believes it has under -0.

PendingExec

The program a process is about to run through the exec shim.

ProcTable

The process table.

Reaper 🔒

The reaper’s epoll descriptor and the pidfd it watches for each process.

TraceeInfo

What the supervisor remembers about one tracee process.

Constants

MAX_ANCESTRY 🔒

Longest parent chain walked when discovering a process.

ORPHAN_TTL 🔒

How long an orphaned fork snapshot stays claimable.

TID_TTL 🔒

How long a cached thread-to-process mapping is trusted.

Traits

TryInsert 🔒

Inserts only when the key is absent; true when inserted.

Functions

read_status

(Tgid, PPid) of a thread from /proc/<tid>/status.