0

There are ways to do some work with linux signal handlers.

  1. We can either register system handlers for every signals (if we have sourcecode) or
  2. Run the process under strace to view them.

Stratergy 1: But if we dont have source code, how can we catch a signals to an application to do something with it and return back? (not a one time debugging but permanent feature). [may be hack a system call?]

Stratergy 2: And in case we do have source code, is writing to a file safe in case of multiple signals ? or is it more safe to execute signal handler in a fork() process and discard SIGCHLD? what happens if another signals comes in when handling previous signal?

Dexters
  • 2,419
  • 6
  • 37
  • 57

2 Answers2

2

For your Stratergy 2, depends on how your log files are written and how the signals are triggered (asynchronously or not). Normally stdio library functions are not async-signal-safe.

See details in http://man7.org/linux/man-pages/man7/signal-safety.7.html

   To avoid problems with unsafe functions, there are two possible
   choices:

   1. Ensure that (a) the signal handler calls only async-signal-safe
      functions, and (b) the signal handler itself is reentrant with
      respect to global variables in the main program.

   2. Block signal delivery in the main program when calling functions
      that are unsafe or operating on global data that is also accessed
      by the signal handler.
Yingyu YOU
  • 369
  • 1
  • 5
0

Stratergy 1: But if we dont have source code, how can we catch a signals to an application to do something with it and return back? (not a one time debugging but permanent feature). [may be hack a system call?]

To intercept a signal delivered to a process there are at least 2 ways:

  • ptrace(2) (which is what strace uses) see this answer for an example.
  • LD_PRELOAD: (I'd not advise this approach) you can use it to set handlers for every signal and replace signal and sigaction with two wrapper functions to prevent the program from overriding your signal handlers (please note the recommendations in this other answer).
smeso
  • 4,165
  • 18
  • 27