Search code examples
linuxkernelstrace

strace init process (PID 1) in linux

The strace manpage says:

On Linux, exciting as it would be, tracing the init process is forbidden.

I checked the same and it doesn't allow it:

$  strace -p 1
attach: ptrace(PTRACE_ATTACH, ...): Operation not permitted

Why isn't it possible? Even the ptrace manpage says the same about tracing init process. Aren't these tools safe or just that the init process is deemed too special that no other processes (strace/ptrace) can signal it.

Solution

  • sudo strace -p 1 works for me ( you need root privileges for strace )
    There was work to allow debugging of init. In 2.4.37 you can't attach to init, but in some kernel this condition was removed - I've found 3.8 kernel

    Edit: on my Kubuntu 15.10 there is no On Linux, exciting as it would be, tracing the init process is forbidden. in strace man. Updated man?