0

Is there way how to find out which program is executing my script?

I'm runnig I3 as my window manager and I want to use sxkhd to bynd keys instead of i3config but something keep replacing my sxkhd bynds, so I want to trace what is it. Maybe I could use strace but I haven't figured out how.

Thanks for answers

EDIT:
turned out I didn't kill my old sxkhd processes so they were guilty for executing my script
butt I am still curious how could I trace these executions

  • Are you on Linux? – Arkadiusz Drabczyk Mar 31 at 20:41
  • Yes, Fedora running I3-gaps – EFK Mar 31 at 20:51
0

On Linux you can get a PID of the parent process from $PPID variable or /proc/pid/status. Parent process is not always a calling process in case of daemons for examples but it usually is. That being said, you can convert every program into a wrapper that will first log PID of its parent process to a file and then execute an original binary. I don't use sxkhd but as you use X11 let's use xeyes as an example. Create xeyes script with the following contents and make it executable:

#!/usr/bin/env sh

printf "PPID: %d\n" "$PPID" >> /tmp/XEYES_RUN
xeyes.orig "$@"

Now rename an original xeyes binary to xeyes.orig:

sudo mv "$(command -v xeyes)" "$(dirname $(command -v xeyes))"/xeyes.orig

Replace original xeyes with a script wrapper:

sudo cp ./xeyes "$(dirname $(command -v xeyes.orig))"

Call xeyes normally:

xeyes

Now every time you run xeyes PID of its parent process will be appended to /tmp/XEYES_RUN. If you start it from the command line it will be PID of your shell, for example /bin/bash.

| improve this answer | |
  • Very nice solution. Got little confused with all $ on the command line, but still understood the point. – EFK Mar 31 at 21:22
0

From the shell, on Linux:

readlink "/proc/$PPID/exe"

In any standard shell, the $PPID variable refers to the parent process. In C, you can get it with getppid(). Most languages have a way to retrieve it (eg. getppid in perl, os.getppid in python, etc).

Once you got the PID of the parent process, mapping it to an executable is bound to be system specific. ps will tell you the process name or the command line arguments, but those are not reliable, as they (generally) don't include the full path and can be modified by the process itself, or by any other process running as the same user.

On Linux, the executable of a process is pointed to by /proc/<pid>/exe. That's a "magic" symlink: even if the original executable was removed or renamed, you still can read it (eg. to copy elsewhere) or execute it again.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.