Question & Answer
Question
If a non-root user tries to run /usr/bin/truss to trace the execution of a program they may be denied with this error: truss: 0915-007 Cannot control child process
Cause
If the program has the SUID bit enabled, or an object file is unreadable, truss will disengage from it if not run by a privileged user.
Also if the user does not have sufficient privileges to read information from the /proc filesystem the truss command will fail.
Answer
If a truss needs to be run against a user executing a command or program, it can be run from a root session while the user stays in their own session.
First, log in as root or su to root. This is the session where you will execute the truss, since it has sufficient privileges to trace the other program.
Next, have the user log in to the system. Make sure their environment is set up to execute the program and replicate the failure or incorrect behavior. Have the user find the process ID of their current shell using this command:
$ echo $$The echo statement above will return the current shell process ID.
Now in the root session, start tracing the user's shell. Replace PID_OF_USER with the PID returned from the echo statement. This will trace all commands and keystrokes from the user.
The options to this truss will save parameters passed to exec (-a), the user's environment (-e), follow any child processes created (-f), and save the output in the named file (-o). The -p option will attach truss to the user's currently running shell.
Now that the truss is attached to the user's shell, have them run the command or program and reproduce the problem.
After the problem has been reproduced, stop the truss in the root session by typing <CTRL-C>. This will quit the truss but allow the user to keep the shell running. Truss will alert you to this by printing a message:
Was this topic helpful?
Document Information
Modified date:
17 June 2018
UID
isg3T1025735