How to find which program is executing given program?

Question

Is there way how to find out which program is executing my script?

I'm runnig I3 as my window manager and I want to use sxkhd to bynd keys instead of i3config but something keep replacing my sxkhd bynds, so I want to trace what is it. Maybe I could use strace but I haven't figured out how.

Thanks for answers

EDIT:
turned out I didn't kill my old sxkhd processes so they were guilty for executing my script
butt I am still curious how could I trace these executions

Answer 1

On Linux you can get a PID of the parent process from $PPID variable or /proc/pid/status. Parent process is not always a calling process in case of daemons for examples but it usually is. That being said, you can convert every program into a wrapper that will first log PID of its parent process to a file and then execute an original binary. I don't use sxkhd but as you use X11 let's use xeyes as an example. Create xeyes script with the following contents and make it executable:

#!/usr/bin/env sh

printf "PPID: %d\n" "$PPID" >> /tmp/XEYES_RUN
xeyes.orig "$@"

Now rename an original xeyes binary to xeyes.orig:

sudo mv "$(command -v xeyes)" "$(dirname $(command -v xeyes))"/xeyes.orig

Replace original xeyes with a script wrapper:

sudo cp ./xeyes "$(dirname $(command -v xeyes.orig))"

Call xeyes normally:

xeyes

Now every time you run xeyes PID of its parent process will be appended to /tmp/XEYES_RUN. If you start it from the command line it will be PID of your shell, for example /bin/bash.

Answer 2

From the shell, on Linux:

readlink "/proc/$PPID/exe"

In any standard shell, the $PPID variable refers to the parent process. In C, you can get it with getppid(). Most languages have a way to retrieve it (eg. getppid in perl, os.getppid in python, etc).

Once you got the PID of the parent process, mapping it to an executable is bound to be system specific. ps will tell you the process name or the command line arguments, but those are not reliable, as they (generally) don't include the full path and can be modified by the process itself, or by any other process running as the same user.

On Linux, the executable of a process is pointed to by /proc/<pid>/exe. That's a "magic" symlink: even if the original executable was removed or renamed, you still can read it (eg. to copy elsewhere) or execute it again.