Enhancements to syscall Arguments Display and Special Flags Interpretation

[theSprog]

Description

While comparing traces from lurk and strace, I've noticed a couple of areas where lurk could potentially enhance its output for better clarity and completeness. Specifically:

1. execve Arguments Display: The execve call in lurk's output doesn't display the full details of the arguments, environment variables, and the command being executed. In contrast, strace provides a more detailed view of these parameters, which is helpful for debugging and analysis purposes.

2. Special Flags Interpretation: There are instances where lurk displays certain special values (e.g., NULL, AT_FDCWD) as their raw numerical equivalents (e.g., 0x0 for NULL, 4294967196 for AT_FDCWD). This raw display might not be immediately clear to users unfamiliar with these values' significance. In comparison, strace translates these into more understandable representations.

Examples

• lurk output for execve:
  [10063] execve("", "", "") = 0

• strace output for execve:
  execve("/usr/sbin/ls", ["ls"], 0x7fff550534c0 /* 68 vars */) = 0

• Special flags:

• lurk shows AT_FDCWD as 4294967196.

• lurk displays NULL as 0x0.

Suggested Enhancements

1. Enhance execve Output: It would be beneficial for lurk to include more details in the execve output, similar to strace. This might include the full command, arguments array, and environment variables block.

2. Improve Special Flags Interpretation: For special constants like AT_FDCWD and NULL, translating these values into their well-known symbolic names (or at least including the symbolic names alongside the raw values) would enhance readability and user understanding.

These enhancements could significantly improve the utility and user experience of lurk for tracing system calls, especially for users transitioning from or comparing outputs with strace.

Additional Information

• Lurk Version: 0.3.4

Thank you for considering these suggestions to improve lurk.