diff options
author | George V. Neville-Neil <gnn@FreeBSD.org> | 2014-07-31 23:19:01 +0000 |
---|---|---|
committer | George V. Neville-Neil <gnn@FreeBSD.org> | 2014-07-31 23:19:01 +0000 |
commit | e1c97af45ef486c1fe395a687aaeab538c71f53c (patch) | |
tree | 74c51764bc41f2d5ff2b2a176e752c67cb0a5c94 /cddl | |
parent | 0523fd7c90e0a4df1c5de96ef1b2a30e41c82bab (diff) | |
download | src-e1c97af45ef486c1fe395a687aaeab538c71f53c.tar.gz src-e1c97af45ef486c1fe395a687aaeab538c71f53c.zip |
Update shellsnoop to work on FreeBSD.
Contributed by: skreuzer
Notes
Notes:
svn path=/head/; revision=269360
Diffstat (limited to 'cddl')
-rwxr-xr-x | cddl/contrib/dtracetoolkit/Apps/shellsnoop | 14 |
1 files changed, 5 insertions, 9 deletions
diff --git a/cddl/contrib/dtracetoolkit/Apps/shellsnoop b/cddl/contrib/dtracetoolkit/Apps/shellsnoop index 95f42c046529..69ff379a6519 100755 --- a/cddl/contrib/dtracetoolkit/Apps/shellsnoop +++ b/cddl/contrib/dtracetoolkit/Apps/shellsnoop @@ -1,4 +1,4 @@ -#!/usr/bin/sh +#!/bin/sh # # shellsnoop - A program to print read/write details from shells, # such as keystrokes and command outputs. @@ -140,18 +140,14 @@ dtrace -n ' /* * Remember this PID is a shell child */ - syscall::exec:entry, syscall::exece:entry + syscall::execve:entry /execname == "sh" || execname == "ksh" || execname == "csh" || execname == "tcsh" || execname == "zsh" || execname == "bash"/ { child[pid] = 1; - /* debug */ - this->parent = (char *)curthread->t_procp->p_parent->p_user.u_comm; - OPT_debug == 1 ? printf("PID %d CMD %s started. (%s)\n", - pid, execname, stringof(this->parent)) : 1; } - syscall::exec:entry, syscall::exece:entry + syscall::execve:entry /(OPT_pid == 1 && PID != ppid) || (OPT_uid == 1 && UID != uid)/ { /* forget if filtered */ @@ -256,12 +252,12 @@ dtrace -n ' /* * Cleanup */ - syscall::rexit:entry + syscall::exit:entry { child[pid] = 0; /* debug */ - this->parent = (char *)curthread->t_procp->p_parent->p_user.u_comm; + this->parent = (char *)curthread->td_proc->p_pptr->p_comm; OPT_debug == 1 ? printf("PID %d CMD %s exited. (%s)\n", pid, execname, stringof(this->parent)) : 1; } |