TL;DR: I know a program creates and then deletes files in /tmp
. How can I intercept them for examination ?
Context:
There's a particular .jar
file, which I don't trust; for some reason its source code contains an ftm method and has capability to make connections, which is evident from network-related syscalls in output of strace
(and when I mean connection, I don't mean unix domain sockets, it's AF_INET6
). I've examined with Wireshark and saw no outgoing TCP or UDP connections during it's use.
However, I still don't quite trust it. From the output of strace
I've seen that it's creating temporary files in /tmp
and then deletes them. Is there a way to intercept those files to examine their contents ?
unlink.so
. Now difference betweenls /tmp
before and after running the command. I'm no expert on shared libraries, or Java, but seems likeunlink.so
wasn't used by it, so just a guess but maybe Java doesn't useunlink()
. I'm hoping someone can suggest a more or less universal way, because I want this to work consistently. I don't care how the program in question is done, I just want to see its temp files. – Sergiy Kolodyazhnyy Sep 10 '18 at 21:00strace
show anything being written to said files? (strace
may need flags to increase how much it logs) – thrig Sep 10 '18 at 21:01strace -f -e open,write,unlink java -jar file.jar input.txt
I see there are writes to particular file descriptors. There'sopenat(AT_FDCWD, "/tmp/imageio1355028222376675525.tmp", O_WRONLY|O_CREAT|O_EXCL, 0600) = 16
, and data written to it appears to be the header of the output png file. So it writes output file totmp
first. I also see another temp file being opened and reopened as fd 4:openat(AT_FDCWD, "/tmp/hsperfdata_xie", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
But I don't see any writes to fd 4. Makes no sense to createO_RDONLY
file and keep it empty – Sergiy Kolodyazhnyy Sep 10 '18 at 21:12/tmp/hsperfdata_$user/
is 'HotSpot performance data' created automatically by the Sun/Oracle/OpenJDK JVM (which is codenamed HotSpot) with the JVM pid as filename and used by utilities likejps jstat jmap jconsole
. See e.g. stackoverflow.com/questions/76327/… stackoverflow.com/questions/3806758/… – dave_thompson_085 Sep 11 '18 at 1:09