add sigqueue instrumentation to killsnoop-bpfcc
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
As noted in https://stackoverflow.com/a/62434615/11582827 the `killsnoop-bpfcc` does not capture signals sent via the `sigqueue` library call, i.e. using the `rt_sigqueueinfo` system call.
Running https://github.com/devnull-cz/unix-linux-prog-in-c-src/blob/701db3599460ab03ed1aa45a8bc7e1dccb462588/signals/sigqueue.c will send the signal via `sigqueue(3)`:
```
$ cc sigqueue.c
$ ./a.out
2043940 sleeping
2043941 waiting
2043940 sending SIGINT signal to 2043941
2043941 exiting with received 42
```
and using the `killsnoop-bpfcc` program with simple modification to instrument the `rt_sigqueueinfo` syscall, it now displays the signal:
```
$ sudo ./killsnoop-bpfcc
TIME PID COMM SIG TPID RESULT
15:33:44 2043940 a.out 2 2043941 0
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the killsnoop-bpfcc entry point and inspect how it instruments signal-related system calls. Compile and run the referenced sigqueue.c example, then run killsnoop-bpfcc while it sends SIGINT through sigqueue. Done means the rt_sigqueueinfo signal appears in the tool output with the target PID and result.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability-sre, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100