[PATCH] make former thread ID available via PTRACE_GETEVENTMSG afterPTRACE_EVENT_EXEC stop

[Denys Vlasenko]

Hi Oleg,

As discussed, the attached patch allows tracer to figure out
which of its potentially many tracees performed an execve,
and what was its former tid.

Not sure what kind of locking, if any, I need to put around
current->parent...

The patch is on top of Tejun's patches.

-- 
vda
diff --git a/fs/exec.c b/fs/exec.c
index a9f2b36..08b1172 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1383,8 +1383,10 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 			 */
 			bprm->recursion_depth = depth;
 			if (retval >= 0) {
-				if (depth == 0)
-					tracehook_report_exec(fmt, bprm, regs);
+				if (depth == 0) {
+					pid_t pid = task_pid_nr_ns(current, task_active_pid_ns(current->parent));
+					tracehook_report_exec(fmt, bprm, regs, pid);
+				}
 				put_binfmt(fmt);
 				allow_write_access(bprm->file);
 				if (bprm->file)
diff --git a/include/linux/tracehook.h b/include/linux/tracehook.h
index 15745cd..3f65005 100644
--- a/include/linux/tracehook.h
+++ b/include/linux/tracehook.h
@@ -199,9 +199,10 @@ static inline struct task_struct *tracehook_tracer_task(struct task_struct *tsk)
  */
 static inline void tracehook_report_exec(struct linux_binfmt *fmt,
 					 struct linux_binprm *bprm,
-					 struct pt_regs *regs)
+					 struct pt_regs *regs,
+					 pid_t pid)
 {
-	if (!ptrace_event(PT_TRACE_EXEC, PTRACE_EVENT_EXEC, 0) &&
+	if (!ptrace_event(PT_TRACE_EXEC, PTRACE_EVENT_EXEC, pid) &&
 	    unlikely(task_ptrace(current) & PT_PTRACED))
 		send_sig(SIGTRAP, current, 0);
 }