I can do
auditctl -a always,exit -S all -F pid=1234
To log all the system calls done by pid 1234 and:
auditctl -a always,exit -S all -F ppid=1234
For its children, but how do I cover the grand-children and their children as well (current and future)?
I cannot rely on (e)uid/(e)gid that do change.
(note that using strace is not an option either)
Just proposing something without having any way to try it right now... but just guessing from the post itself
Here is a proposal of solution:
Assuming the topmost process id is in $pid, and that on linux as well ps -T gives out the tree of processes (I can't have access to linux at the moment)
for eachpid in $(ps -T "$pid" | awk '{print $1}' | grep -v 'PID')
do
auditctl -a always,exit -S all -F pid=$eachpid >somelog_${eachpid}.log 2>&1
done
Of course, replace ps -T "$pid" with the equivalent for linux, if that one doesn't work on linux (or find it by awk-ing the "pstree -p" output, the pid will be between parenthesis)
strace -s^^ but then I saw who was asking and immediately knew "he knows that already!" )... Stephane, can you maybe: 1) build the list of pids using the "tree" option of ps, 2) launch auditctl(s) on all the pids listed in the tree ? (ie, can you have multiple "pid=...." ? or multiple auditctl, each on one?) or the "dumb" way: auditctl everything, and some kind of egrep on the "pid|pid|pid" if they appear on each line?) (caveat: I don't have access to linux atm, so I have no idea how infos appear)