Add support for executing a program and tracing it (#5362)

For short-lived processes, specify '-p pid' is difficult to trace. Add support for executing a program and tracing it. When the newly child process exits, tool itself exists subsequently.

Added to syscount/opensnoop tools this time, other tools as needed.

For example:
./syscount.py -i 1 --exec ls -l /tmp

Author: xingfeng2510

src/python/bcc/exec.py

@@ -0,0 +1,66 @@
+# Copyright 2025 Rocky Xing
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import signal
+import sys
+
+child_exit = 0
+
+pipe_read, pipe_write = os.pipe()
+
+def _child_signal_handler(signum, frame):
+    while True:
+        try:
+            pid, status = os.waitpid(-1, os.WNOHANG)
+            if pid == 0:
+                break
+        except OSError:
+            break
+
+    global child_exit
+    child_exit = 1
+
+def run_cmd(args) -> int:
+    pid = os.fork()
+    if pid < 0:
+        print("failed to fork", file=sys.stderr)
+        sys.exit(1)
+    elif pid == 0:
+        try:
+            os.close(pipe_write)
+            os.read(pipe_read, 1)
+            os.execvp(args[0], args)
+        except OSError as e:
+            print("failed to exec command: %s: %s" % (' '.join(args), e), file=sys.stderr)
+            sys.exit(1)
+        finally:
+            os.close(pipe_read)
+            sys.exit(0)
+    else:
+        signal.signal(signal.SIGCHLD, _child_signal_handler)
+        return pid
+
+def cmd_ready():
+    try:
+        os.close(pipe_read)
+        os.write(pipe_write, b'x')
+    except OSError as e:
+        sys.exit(1)
+    finally:
+        os.close(pipe_write)
+
+def cmd_exited():
+    return child_exit
+

tools/opensnoop.py

@@ -19,10 +19,12 @@
 # 06-Jan-2019   Takuma Kume     Support filtering by UID
 # 21-Aug-2022   Rocky Xing      Support showing full path for an open file.
 # 06-Sep-2022   Rocky Xing      Support setting size of the perf ring buffer.
+# 13-Jul-2025   Rocky Xing      Execute a program and trace it's open() syscalls.
 
 from __future__ import print_function
 from bcc import ArgString, BPF
 from bcc.containers import filter_by_containers
+from bcc.exec import run_cmd, cmd_ready, cmd_exited
 from bcc.utils import printb
 import argparse
 from collections import defaultdict
@@ -82,8 +84,20 @@
 parser.add_argument("-b", "--buffer-pages", type=int, default=64,
     help="size of the perf ring buffer "
         "(must be a power of two number of pages and defaults to 64)")
+parser.add_argument('--exec', nargs=argparse.REMAINDER,
+    help="execute command (as the last parameter, "
+        "supports multiple parameters, for example: --exec ls -l /tmp")
 args = parser.parse_args()
 debug = 0
+
+if args.pid and args.exec:
+    print("ERROR: can only use -p or --exec. Exiting.")
+    exit()
+
+if args.exec is not None and len(args.exec) == 0:
+    print("ERROR: --exec without command. Exiting.")
+    exit()
+
 if args.duration:
     args.duration = timedelta(seconds=int(args.duration))
 flag_filter_mask = 0
@@ -399,6 +413,12 @@
         'if (pid != %s) { return 0; }' % args.pid)
     bpf_text = bpf_text.replace('KFUNC_PID_TID_FILTER',
         'if (pid != %s) { events.ringbuf_discard(data, 0); return 0; }' % args.pid)
+elif args.exec:
+    child_pid = run_cmd(args.exec)
+    bpf_text = bpf_text.replace('KPROBE_PID_TID_FILTER',
+        'if (pid != %s) { return 0; }' % child_pid)
+    bpf_text = bpf_text.replace('KFUNC_PID_TID_FILTER',
+        'if (pid != %s) { events.ringbuf_discard(data, 0); return 0; }' % child_pid)
 else:
     bpf_text = bpf_text.replace('KPROBE_PID_TID_FILTER', '')
     bpf_text = bpf_text.replace('KFUNC_PID_TID_FILTER', '')
@@ -514,6 +534,9 @@
         b.attach_kprobe(event=fnname_openat2, fn_name="syscall__trace_entry_openat2")
         b.attach_kretprobe(event=fnname_openat2, fn_name="trace_return")
 
+if args.exec:
+   cmd_ready()
+
 initial_ts = 0
 
 # header
@@ -604,3 +627,5 @@ def print_event(cpu, data, size):
         b.ring_buffer_poll()
     except KeyboardInterrupt:
         exit()
+    if args.exec and cmd_exited():
+        exit()

tools/syscount.py

@@ -11,14 +11,17 @@
 # 15-Feb-2017   Sasha Goldshtein    Created this.
 # 16-May-2022   Rocky Xing          Added TID filter support.
 # 26-Jul-2022   Rocky Xing          Added syscall filter support.
+# 12-Jul-2025   Rocky Xing          Execute a program and trace it's syscalls.
 
 from time import sleep, strftime
 import argparse
 import errno
 import itertools
+import os
 import sys
 import signal
 from bcc import BPF
+from bcc.exec import run_cmd, cmd_ready, cmd_exited
 from bcc.utils import printb
 from bcc.syscall import syscall_name, syscalls
 
@@ -73,12 +76,23 @@ def handle_errno(errstr):
     help="trace this syscall only (use option -l to get all recognized syscalls)")
 parser.add_argument("--ebpf", action="store_true",
     help=argparse.SUPPRESS)
+parser.add_argument('--exec', nargs=argparse.REMAINDER,
+    help="execute command (as the last parameter, "
+        "supports multiple parameters, for example: --exec ls -l /tmp")
 args = parser.parse_args()
 if args.duration and not args.interval:
     args.interval = args.duration
 if not args.interval:
     args.interval = 99999999
 
+if args.pid and args.exec:
+    print("ERROR: can only use -p or --exec. Exiting.")
+    exit()
+
+if args.exec is not None and len(args.exec) == 0:
+    print("ERROR: --exec without command. Exiting.")
+    exit()
+
 syscall_nr = -1
 if args.syscall is not None:
     syscall = bytes(args.syscall, 'utf-8')
@@ -211,6 +225,8 @@ def handle_errno(errstr):
 
 if args.pid:
     text = ("#define FILTER_PID %d\n" % args.pid) + text
+elif args.exec:
+    text = ("#define FILTER_PID %d\n" % run_cmd(args.exec)) + text
 elif args.tid:
     text = ("#define FILTER_TID %d\n" % args.tid) + text
 elif args.ppid:
@@ -231,6 +247,9 @@ def handle_errno(errstr):
 
 bpf = BPF(text=text)
 
+if args.exec:
+   cmd_ready()
+
 def print_stats():
     if args.latency:
         print_latency_stats()
@@ -303,6 +322,8 @@ def print_latency_stats():
         signal.signal(signal.SIGINT, signal_ignore)
     if args.duration and seconds >= args.duration:
         exiting = 1
+    if args.exec and cmd_exited():
+        exiting = 1
 
     print_stats()