During compilation of most (if not all) software packages, the output on stdout and stderr is created by multiple individual processes and the files that are processed/changed/created in the course of a build are handled by multiple different processes as well. This is because the build systems of (probably most) software packages relies on several different pieces of software to produce the final build result.
It would be very useful if a build process under Linux (or a BSD) could be transparently traced such such that one could retrieve the following information:
- which process was it that produced what information on stdout and stderr (and what are the ancestors of that process)
- which process was it that read a certain file
- which process was it that was writing a certain file
This information would be useful to:
- generate linearized build logs even for builds that were carried out in parallel
- make it possible to automatically associate input source files with output binaries
- detect embedded code copies
- check for GPL compliance (because we now know which files were linked together)
- find out the license that applies to the created binary (because we know which source files were used to produce it)
The alternative to doing this tracing of program execution would be to modify every single program which ever produces or changes files and make them all have a unified machine readable output format. Given how many programs are involved in the compilation of software (compilers for different languages, documentation generators, image converters or even Unix commands like sed, grep, cp or mv) this is infeasible.
Linux provides a couple of ways to trace all system calls that were made by a process and all its children. But ptrace or LD_PRELOAD based mechanisms do influence some builds in a way such that they will either fail or produce different results compared to when they are not traced by either method. And systemtap will often skip probes as it's only passively listening and not slowing down a process if events occur too fast.
So what I'm looking for is a way to reliabley trace the system calls made by a process and all its children in a way that is completely transparent (except that it will likely influence execution time) to the process and all its children.
Is this possible in Linux (or BSD)? If yes, how?