Redirecting stderr of a running process May 4, 2018 on Drew DeVault's blog

During the KDE sprint in Berlin, Roman Gilg leaned over to me and asked if I knew how to redirect the stderr of an already-running process to a file. I Googled it and found underwhelming answers using strace and trying to decipher the output by reading the write syscalls. Instead, I thought a gdb based approach would work better, and after putting the pieces together Roman insisted I wrote a blog post on the topic.

gdb, the GNU debugger, has two important features that make this possible:

With this it’s actually quite straightforward. The process is the following:

  1. Attach gdb to the running process
  2. Run compile code -- dup2(open("/tmp/log", 65), 2)

The magic 65 here is the value of O_CREAT | O_WRONLY on Linux, which is easily found with a little program like this:

#include <sys/stat.h>
#include <fcntl.h>

int main(int argc, char **argv) {
    printf("%d\n", O_CREAT | O_WRONLY);
    return 0;
}

2 is always the file descriptor assigned to stderr. What happens here is:

  1. Via open, the file you want to redirect to is created.
  2. Via dup2, stderr is overwritten with this new file.

The compile code gdb command will compile some arbitrary C code and run the result in the target process, presumably by mapping some executable RAM and loading it in, then jumping to the blob. Closing gdb (control+d) will continue the process, and it should start writing out to the file you created.

There are lots of other cool (and hacky) things you can do with gdb. I once disconnected someone from an internet radio by attaching gdb to nginx and closing their file descriptor, for example. Thanks to Roman for giving me the chance to write an interesting blog post on the subject!

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Site Redesign

Hey y’all! It’s been, gosh, what, ten years? I finally finished a total site redesign: all-new backend, HTML, CSS, modern image formats, etc. It’s finally readable on mobile now! There’s a lot of accumulated cruft in the database and filesystem–aphyr.com i…

via Aphyr: Posts March 28, 2021

What's cooking on SourceHut? March 2021

Hi! Another month of development has passed, and I’m here to fill you in on what’s new. Another 686 signups this month has brought us to 21,041 users. As always, I’ll be counting on you to make the new users feel at home, please be patient with them and help…

via Blogs on Sourcehut March 15, 2021

Status update, March 2021

Hi all! This month has been a little bit more quiet than others. I’ve spent a fair bit of time working on gamescope for Valve. As usual I’ve been fixing bugs and improving gamescope itself, but I’ve also worked on the rest of the ecosystem. I’m plumbing forma…

via emersion March 15, 2021