ptrace.2: Add information on PTRACE_SEIZE versus PTRACE_ATTACH differences

Extend description of PTRACE_SEIZE with the short summary of its
differences from PTRACE_ATTACH.

The following paragraph:

PTRACE_EVENT_STOP
       Stop induced by PTRACE_INTERRUPT command, or group-stop, or ini-
       tial  ptrace-stop when a new child is attached (only if attached
       using PTRACE_SEIZE), or PTRACE_EVENT_STOP if PTRACE_SEIZE was used.

has an editing error (the part after last comma makes no sense).
Removing it.

Mention that legacy post-execve SIGTRAP is disabled by PTRACE_SEIZE.

Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>

diff --git a/man2/ptrace.2 b/man2/ptrace.2
index 0365698bde2bc2f1692f797c1a6e21e633e42d48..1dc5f28299cd01bd65ff351b95bb8715e2e96a0a 100644 (file)
--- a/man2/ptrace.2
+++ b/man2/ptrace.2
@@ -781,6 +781,23 @@ Unlike
 .BR PTRACE_ATTACH ,
 .B PTRACE_SEIZE
 does not stop the process.
+Group-stops are reported as
+.B PTRACE_EVENT_STOP
+with
+.I WSTOPSIG(status)
+== stopping_signal.
+Automatically attached children stop with
+.B PTRACE_EVENT_STOP
+with
+.I WSTOPSIG(status)
+==
+.B SIGTRAP
+instead of having
+.B SIGSTOP
+signal delivered to them.
+.BR evecve (2)
+does not deliver an extra
+.BR SIGTRAP.
 Only a
 .BR PTRACE_SEIZE d
 process can accept
@@ -788,6 +805,12 @@ process can accept
 and
 .B PTRACE_LISTEN
 commands.
+The "seized" behavior just described is inherited by
+children that are automatically attached using
+.BR PTRACE_O_TRACEFORK ,
+.BR PTRACE_O_TRACEVFORK ,
+and
+.BR PTRACE_O_TRACECLONE .
 .I addr
 must be zero.
 .I data
@@ -1337,12 +1360,7 @@ Stop induced by
 .B PTRACE_INTERRUPT
 command, or group-stop, or initial ptrace-stop when a new child is attached
 (only if attached using
-.BR PTRACE_SEIZE ),
-or
-.B PTRACE_EVENT_STOP
-if
-.B PTRACE_SEIZE
-was used.
+.BR PTRACE_SEIZE ).
 .TP
 .B PTRACE_EVENT_SECCOMP
 Stop triggered by a
@@ -1837,7 +1855,12 @@ If the
 .B PTRACE_O_TRACEEXEC
 option is
 .I not
-in effect for the execing tracee, the kernel delivers an extra
+in effect for the execing tracee,
+and if tracee was
+.BR PTRACE_ATTACH ed
+rather that
+.BR PTRACE_SEIZE d,
+the kernel delivers an extra
 .B SIGTRAP
 to the tracee after
 .BR execve (2)
@@ -1870,7 +1893,9 @@ However, determining
 to suppress is not easy.
 Setting the
 .B PTRACE_O_TRACEEXEC
-option and thus suppressing this extra
+option or using
+.B PTRACE_SEIZE
+and thus suppressing this extra
 .B SIGTRAP
 is the recommended approach.
 .SS Real parent