> If the tracee enters PTRACE_EVENT_EXEC stop without TIF_SYSCALL_TRACE
> and then the tracer does ptrace(PTRACE_SYSCALL), we should report
> SYSCALL_EXIT event.

Indeed.  But note that without PTRACE_O_TRACEEXEC, we do not have an "event
stop", but just send ourselves a normal signal.  In that case, a
PTRACE_SYSCALL resuming from the entry stop for execve will hit the exit
stop first (just like any other syscall), and then dequeue the signal.


Thanks,
Roland

Reply via email to