execsnoop misses arguments randomly on arm64
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
While running execsnoop, and this shell script
```
while : ; do
ls -la /tmp
sleep 1
done
```
I get the following output from `execsnoop` :
```
PCOMM PID PPID RET ARGS
ls 7168 7125 0 /usr/bin/ls /tmp
sleep 7169 7125 0
ls 7170 7125 0 /usr/bin/ls --color=auto
sleep 7171 7125 0
ls 7172 7125 0 /usr/bin/ls --color=auto
sleep 7173 7125 0 /usr/bin/sleep
ls 7174 7125 0 /usr/bin/ls -la /tmp
sleep 7175 7125 0 /usr/bin/sleep 1
ls 7176 7125 0 /usr/bin/ls -la /tmp
sleep 7177 7125 0 1
```
Sometimes the arguments are catched properly, sometimes only some of them. It seems to be pretty random.
This is happening on arm64 only. I tested on both 5.11 and 5.8 kernels and on 2 different ARM hardwares.
Any idea on what is happening ?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.