2

Let's assume I have this line at the start of my ~/.bash_profile:

echo "*** THIS IS ~/.bash_profile RUNNING ***"

On a Linux machine (Ubuntu 14.04), I can inspect which files bash loads at startup with strace, so I do this:

strace -f bash --login 2>&1 | tee /tmp/log.strace
# type [ENTER] here, or "hello" [ENTER], then Ctrl+C to exit
grep 'bash_' /tmp/log.strace

The result is as expected:

faccessat(AT_FDCWD, "/etc/profile.d/bash_completion.sh", R_OK) = 0
open("/etc/profile.d/bash_completion.sh", O_RDONLY) = 3
open("~/.bash_profile", O_RDONLY) = 3
read(3, "echo \"*** THIS IS ~/.bash_profil"..., 48) = 48
write(1, "*** THIS IS ~/.bash_profile RUNN"..., 40*** THIS IS ~/.bash_profile RUNNING ***

However, I've logged in on an OSX 10.9 machine via ssh, and I need to do the same. Since there is no strace on OSX, I used dtruss, like this:

dtruss -f bash --login 2>&1 | tee /tmp/log.dtruss
# type [ENTER] here, or "hello" [ENTER], then Ctrl+C to exit
grep 'bash_' /tmp/log.dtruss

Strangely, there seems to be no mention of ~/.bash_profile ever being loaded:

$ grep 'bash_' /tmp/log.dtruss
$

..., - even if, if I just run bash --login on that OSX machine, I can see the above echo being printed, which means ~/.bash_profile must be loaded?!

Of course, dtruss does report accessing other files:

$ grep 'open\|stat' /tmp/log.dtruss 
41819/0xce5a2:  stat64("/AppleInternal\0", 0x7FFF5CBC2A88, 0x0)      = -1 Err#2
41819/0xce5a2:  stat64("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x7FFF5CBC23F8, 0x7FFF5CBC3330)         = 0 0
41819/0xce5a2:  open("/usr/lib/dtrace/libdtrace_dyld.dylib\0", 0x0, 0x0)         = 3 0
41819/0xce5a2:  stat64("/usr/lib/libncurses.5.4.dylib\0", 0x7FFF5CBC2208, 0x7FFF5CBC30A0)        = 0 0
...
41819/0xce5a2:  open("/dev/tty\0", 0x6, 0x7FFF79D33940)      = 3 0
41819/0xce5a2:  open_nocancel("/usr/share/locale/en_US.UTF-8/LC_COLLATE\0", 0x0, 0x1B6)      = 3 0
...
41819/0xce5a2:  stat64("~/.fastlane/bin/bash\0", 0x7FFF5CBC37E0, 0x0)        = -1 Err#2
41819/0xce5a2:  stat64("/usr/bin/bash\0", 0x7FFF5CBC37E0, 0x0)       = -1 Err#2
41819/0xce5a2:  stat64("/bin/bash\0", 0x7FFF5CBC37E0, 0x0)       = 0 0
41819/0xce5a2:  stat64("/bin/bash\0", 0x7FFF5CBC3820, 0x0)       = 0 0
...

..., for instance we can see that the $HOME directory is accessed as part of searching through $PATH (and in fact, that PATH="~/.fastlane/bin:$PATH" is set in that very same ~/.bash_profile).

My question is - how come this happens? Is there a special invocation of dtruss that I need to use, so it reports when files like ~/.bash_profile are accessed? Or is there another program on OSX that I should use to achieve the same kind of file open tracing, that strace allows on Linux? Or is the process starting on OSX so different, that it "loads" ~/.bash_profile for a bash process somehow in the background, before bash ever starts running as a standalone process?

sdaau
  • 6,668
  • 12
  • 57
  • 69
  • When I run `sudo dtruss -f bash --login 2>&1 | tee blah` I see `open("/var/root/.bash_profile\0", 0x0, 0x272) = -1 Err#2` in the log. That's the MacPorts version of `bash`. The vendor provided `/bin/bash` gets `dtrace: failed to execute /bin/bash: dtrace cannot control executables signed with restricted entitlements` – thrig Oct 24 '17 at 16:42
  • Do you log into Ubuntu machine with ssh also ? – Sergiy Kolodyazhnyy Oct 24 '17 at 17:29

0 Answers0