Showcases

TUI mode with pseudo terminal

Tracing setuid binaries

sudo tracexec --user $(whoami) tui -t -- sudo ls

Use tracexec as a debugger launcher

eBPF mode

System-wide Exec Tracing

sudo -E tracexec ebpf tui

Follow Fork mode with eBPF

sudo -E tracexec --user$(whoami) ebpf tui -t -- bash

Log mode

Reconstruct the command line with--show-cmdline

$ tracexec log --show-cmdline --<command># example:$ tracexec log --show-cmdline -- firefox

Try to reproduce stdio in the reconstructed command line

tracexec log --show-cmdline --stdio-in-cmdline -- bash

Show the interpreter indicated by shebang with--show-interpreter

$ tracexec log --show-interpreter --show-cwd --<command># example: Running Arch Linux makepkg$ tracexec log --show-interpreter --show-cwd -- makepkg -f

Usage

Tracerfor execve{,at} and pre-exec behavior, launcherfor debuggers.Usage: tracexec [OPTIONS]<COMMAND>Commands:  log                   Run tracexecin logging mode  tui                   Run tracexecin TUI mode, stdin/out/err are redirected to /dev/null by default  generate-completions  Generate shell completionsfor tracexec  collect               Collectexec events andexport them  ebpf                  Experimental ebpf modehelp                  Print this message or thehelp of the given subcommand(s)Options:      --color<COLOR>      Control whether colored output is enabled. This flag has no effect on TUI mode. [default: auto] [possible values: auto, always, never]  -C, --cwd<CWD>          Change current directory to this path before doing anything  -P, --profile<PROFILE>  Load profile from this path      --no-profile         Do not load profiles  -u, --user<USER>        Run as user. This option is only available when running tracexec as root  -h, --help               Printhelp  -V, --version            Print version

Run tracexecin TUI mode, stdin/out/err are redirected to /dev/null by defaultUsage: tracexec tui [OPTIONS] --<CMD>...Arguments:<CMD>...command to be executedOptions:      --successful-only          Only show successful calls      --fd-in-cmdline          [Experimental] Try to reproduce file descriptorsin commandline. This might resultin an unexecutable cmdlineif pipes, sockets, etc. are involved.      --stdio-in-cmdline          [Experimental] Try to reproduce stdioin commandline. This might resultin an unexecutable cmdlineif pipes, sockets, etc. are involved.      --resolve-proc-self-exe          Resolve /proc/self/exe symlink      --no-resolve-proc-self-exe          Do not resolve /proc/self/exe symlink      --seccomp-bpf<SECCOMP_BPF>          Controls whether toenable seccomp-bpf optimization, which greatly improves performance [default: auto] [possible values: auto, on, off]      --tracer-delay<TRACER_DELAY>          Delay between polling,in microseconds. The default is 500 when seccomp-bpf is enabled, otherwise 1.      --show-all-events          Set the default filter to show all events. This option can be usedin combination with --filter-exclude to exclude some unwanted events.      --filter<FILTER>          Set the default filterfor events. [default: warning,error,exec,tracee-exit]      --filter-include<FILTER_INCLUDE>          Aside from the default filter, also include the events specified here. [default:<empty>]      --filter-exclude<FILTER_EXCLUDE>          Exclude the events specified here from the default filter. [default:<empty>]  -t, --tty          Allocate a pseudo terminal and show it alongside the TUI  -f, --follow          Keep the event list scrolled to the bottom      --terminate-on-exit          Instead of waitingfor the root child to exit, terminate when the TUI exits      --kill-on-exit          Instead of waitingfor the root child to exit,kill when the TUI exits  -A, --active-pane<ACTIVE_PANE>          Set the default active pane to use when TUI launches [possible values: terminal, events]  -L, --layout<LAYOUT>          Set the layout of the TUI when it launches [possible values: horizontal, vertical]  -F, --frame-rate<FRAME_RATE>          Set the frame rate of the TUI (60 by default)  -m, --max-events<MAX_EVENTS>          Max number of events to keepin TUI (0=unlimited)  -D, --default-external-command<DEFAULT_EXTERNAL_COMMAND>          Set the default externalcommand to run when using"Detach, Stop and Run Command" featurein Hit Manager  -b, --add-breakpoint<BREAKPOINTS>          Add a new breakpoint to the tracer. This option can be used multiple times. The format is<syscall-stop>:<pattern-type>:<pattern>, where syscall-stop can be sysenter or sysexit, pattern-type can be argv-regex, in-filename or exact-filename. For example, sysexit:in-filename:/bash  -h, --help          Printhelp

Run tracexecin logging modeUsage: tracexec log [OPTIONS] --<CMD>...Arguments:<CMD>...command to be executedOptions:      --more-colors          More colors      --less-colors          Less colors      --show-cmdline          Print commandline that (hopefully) reproduces what was executed. Note: file descriptors are not handledfor now.      --no-show-cmdline          Don't print commandline that (hopefully) reproduces what was executed.      --show-interpreter          Try to show script interpreter indicated by shebang      --no-show-interpreter          Do not show script interpreter indicated by shebang      --foreground          Set the terminal foreground process group to tracee. This option is useful when tracexec is used interactively. [default]      --no-foreground          Do not set the terminal foreground process group to tracee      --diff-fd          Diff file descriptors with the original std{in/out/err}      --no-diff-fd          Do not diff file descriptors      --show-fd          Show file descriptors      --no-show-fd          Do not show file descriptors      --diff-env          Diff environment variables with the original environment      --no-diff-env          Do not diff environment variables      --show-env          Show environment variables      --no-show-env          Do not show environment variables      --show-comm          Show comm      --no-show-comm          Do not show comm      --show-argv          Show argv      --no-show-argv          Do not show argv      --show-filename          Show filename      --no-show-filename          Do not show filename      --show-cwd          Show cwd      --no-show-cwd          Do not show cwd      --decode-errno          Decode errno values      --no-decode-errno          Do not decode errno values      --successful-only          Only show successful calls      --fd-in-cmdline          [Experimental] Try to reproduce file descriptors in commandline. This might result in an unexecutable cmdline if pipes, sockets, etc. are involved.      --stdio-in-cmdline          [Experimental] Try to reproduce stdio in commandline. This might result in an unexecutable cmdline if pipes, sockets, etc. are involved.      --resolve-proc-self-exe          Resolve /proc/self/exe symlink      --no-resolve-proc-self-exe          Do not resolve /proc/self/exe symlink      --seccomp-bpf <SECCOMP_BPF>          Controls whether to enable seccomp-bpf optimization, which greatly improves performance [default: auto] [possible values: auto, on, off]      --tracer-delay <TRACER_DELAY>          Delay between polling, in microseconds. The default is 500 when seccomp-bpf is enabled, otherwise 1.      --show-all-events          Set the default filter to show all events. This option can be used in combination with --filter-exclude to exclude some unwanted events.      --filter <FILTER>          Set the default filter for events. [default: warning,error,exec,tracee-exit]      --filter-include <FILTER_INCLUDE>          Aside from the default filter, also include the events specified here. [default: <empty>]      --filter-exclude <FILTER_EXCLUDE>          Exclude the events specified here from the default filter. [default: <empty>]  -o, --output <OUTPUT>          Output, stderr by default. A single hyphen'-' represents stdout.  -h, --help          Print help

Collect exec events and export themUsage: tracexec collect [OPTIONS] --format <FORMAT> -- <CMD>...Arguments:  <CMD>...  command to be executedOptions:      --successful-only              Only show successful calls      --fd-in-cmdline                [Experimental] Try to reproduce file descriptors in commandline. This might result in an unexecutable cmdline if pipes, sockets, etc. are involved.      --stdio-in-cmdline             [Experimental] Try to reproduce stdio in commandline. This might result in an unexecutable cmdline if pipes, sockets, etc. are involved.      --resolve-proc-self-exe        Resolve /proc/self/exe symlink      --no-resolve-proc-self-exe     Do not resolve /proc/self/exe symlink      --seccomp-bpf <SECCOMP_BPF>    Controls whether to enable seccomp-bpf optimization, which greatly improves performance [default: auto] [possible values: auto, on, off]      --tracer-delay <TRACER_DELAY>  Delay between polling, in microseconds. The default is 500 when seccomp-bpf is enabled, otherwise 1.  -F, --format <FORMAT>              the format for exported exec events [possible values: json-stream, json]  -p, --pretty                       prettify the output if supported  -o, --output <OUTPUT>              Output, stderr by default. A single hyphen '-' represents stdout.      --foreground                   Set the terminal foreground process group to tracee. This option is useful when tracexec is used interactively. [default]      --no-foreground                Do not set the terminal foreground process group to tracee  -h, --help                         Print help

Experimental ebpf modeUsage: tracexec ebpf <COMMAND>Commands:  log      Run tracexec in logging mode  tui      Run tracexec in TUI mode, stdin/out/err are redirected to /dev/null by default  collect  Collect exec events and export them  help     Print this message or the help of the given subcommand(s)Options:  -h, --help  Print help

Profile

Known issues

Origin

Credits