#!/usr/bin/env python3 """ parse_strace.py - turn a raw strace log into "what did this ELF touch?" tables. Input : an strace log produced with at least strace -f -y -yy -s 256 -e trace=%file,%desc,%process,%network Output: a Markdown report on stdout (or -o FILE) plus optional CSVs. Written for python3.9 (RHEL 9 system python), stdlib only. """ import argparse import collections import csv import os import re import sys # ---------------------------------------------------------------- patterns -- # "1234 12345.678901 openat(AT_FDCWD, \"/etc/hosts\", O_RDONLY) = 3 <0.000012>" LINE_RE = re.compile( r"""^(?P\d+)\s+ # -f gives a pid column (?:(?P[\d:.]+)\s+)? # -t/-ttt timestamp (optional) (?P.*)$""", re.X, ) CALL_RE = re.compile( r"""^(?P[a-zA-Z_][a-zA-Z0-9_]*)$ (?P.*?) $\s+=\s+(?P-?\d+|\?|0x[0-9a-f]+) (?P<[^>]*>)? # -y annotation on the return fd (?:\s+(?P[A-Z][A-Z0-9_]+)\s+$(?P[^)]*)$)?""", re.X, ) UNFINISHED_RE = re.compile(r"^(?P[a-zA-Z_][a-zA-Z0-9_]*)\((?P.*?)\s*$") RESUMED_RE = re.compile(r"^<\.\.\. (?P[a-zA-Z_][a-zA-Z0-9_]*) resumed>(?P.*)$") EXIT_RE = re.compile(r"^\+\+\+ exited with (?P
-?\d+) \+\+\+")
KILLED_RE = re.compile(r"^\+\+\+ killed by (?P\w+)")
SIG_RE = re.compile(r"^--- (?PSIG\w+) ")
# an fd argument annotated by -y:  3   or  3
FD_ANN_RE = re.compile(r"^(?P\d+)<(?P.*)>$")
STR_RE = re.compile(r'"((?:[^"\\]|\\.)*)"')

# --------------------------------------------------------------- syscall map -
# call -> (index of the path argument, index of the dirfd argument or None, access class)
PATH_CALLS = {
    "open":        (0, None, "open"),
    "creat":       (0, None, "create"),
    "openat":      (1, 0,    "open"),
    "openat2":     (1, 0,    "open"),
    "stat":        (0, None, "stat"),
    "lstat":       (0, None, "stat"),
    "statx":       (1, 0,    "stat"),
    "newfstatat":  (1, 0,    "stat"),
    "access":      (0, None, "stat"),
    "faccessat":   (1, 0,    "stat"),
    "faccessat2":  (1, 0,    "stat"),
    "readlink":    (0, None, "stat"),
    "readlinkat":  (1, 0,    "stat"),
    "unlink":      (0, None, "delete"),
    "unlinkat":    (1, 0,    "delete"),
    "rmdir":       (0, None, "delete"),
    "mkdir":       (0, None, "create"),
    "mkdirat":     (1, 0,    "create"),
    "rename":      (0, None, "write"),
    "renameat":    (1, 0,    "write"),
    "renameat2":   (1, 0,    "write"),
    "chmod":       (0, None, "write"),
    "fchmodat":    (1, 0,    "write"),
    "chown":       (0, None, "write"),
    "fchownat":    (1, 0,    "write"),
    "truncate":    (0, None, "write"),
    "utime":       (0, None, "write"),
    "utimes":      (0, None, "write"),
    "utimensat":   (1, 0,    "write"),
    "symlink":     (1, None, "create"),
    "link":        (1, None, "create"),
    "mknod":       (0, None, "create"),
    "chdir":       (0, None, "stat"),
    "execve":      (0, None, "exec"),
    "execveat":    (1, 0,    "exec"),
    "statfs":      (0, None, "stat"),
    "getxattr":    (0, None, "stat"),
    "lgetxattr":   (0, None, "stat"),
    "setxattr":    (0, None, "write"),
    "inotify_add_watch": (1, None, "stat"),
}
# fd-based calls: the access class we credit to whatever path the fd points at
FD_CALLS = {
    "read": "read", "pread64": "read", "readv": "read", "preadv": "read",
    "preadv2": "read", "getdents": "read", "getdents64": "read",
    "sendfile": "read", "copy_file_range": "read", "fstat": "stat",
    "fstatfs": "stat", "fgetxattr": "stat", "flock": "stat", "fcntl": "stat",
    "lseek": "seek", "ioctl": "ioctl",
    "write": "write", "pwrite64": "write", "writev": "write",
    "pwritev": "write", "pwritev2": "write", "ftruncate": "write",
    "fsync": "write", "fdatasync": "write", "fchmod": "write", "fchown": "write",
    "mmap": "mmap",
}
PROC_CALLS = {"clone", "clone3", "fork", "vfork", "execve", "execveat", "wait4",
              "waitid", "kill", "tgkill", "exit_group", "ptrace"}
NET_CALLS = {"socket", "connect", "bind", "accept", "accept4", "listen",
             "sendto", "recvfrom", "sendmsg", "recvmsg", "getpeername",
             "socketpair", "setsockopt"}

CLASS_ORDER = ["exec", "create", "write", "delete", "open", "read", "mmap",
               "stat", "seek", "ioctl"]


def split_args(s):
    """Split a strace argument list on top-level commas."""
    out, depth, cur, in_str, esc = [], 0, [], False, False
    for ch in s:
        if esc:
            cur.append(ch); esc = False; continue
        if ch == "\\":
            cur.append(ch); esc = True; continue
        if ch == '"':
            in_str = not in_str; cur.append(ch); continue
        if not in_str:
            if ch in "([{<":
                depth += 1
            elif ch in ")]}>":
                depth -= 1
            elif ch == "," and depth == 0:
                out.append("".join(cur).strip()); cur = []; continue
        cur.append(ch)
    if cur:
        out.append("".join(cur).strip())
    return out


def unquote(a):
    m = STR_RE.search(a)
    if not m:
        return None
    return m.group(1).encode().decode("unicode_escape", "replace")


class Proc:
    def __init__(self, pid, parent=None):
        self.pid = pid
        self.parent = parent
        self.children = []
        self.argv = None
        self.exe = None
        self.images = []          # every image this pid execve'd, in order
        self.is_thread = False    # created with CLONE_THREAD: a thread, not a process
        self.exit = None
        self.signal = None
        self.syscalls = collections.Counter()


class Trace:
    def __init__(self, cwd):
        self.cwd = cwd
        self.procs = {}
        self.fds = collections.defaultdict(dict)      # pid -> fd -> path
        self.files = {}                               # path -> record
        self.net = []                                 # (pid, call, detail, result)
        self.execs = []                               # (pid, path, argv)
        self.errors = collections.Counter()
        self.first_pid = None

    # ---- helpers ----------------------------------------------------------
    def proc(self, pid):
        p = self.procs.get(pid)
        if p is None:
            p = self.procs[pid] = Proc(pid)
            if self.first_pid is None:
                self.first_pid = pid
        return p

    @staticmethod
    def clean_ann(path):
        """Strip the trailing type hint -yy adds, e.g. /dev/null."""
        if path.endswith(">") and "<" in path:
            head, _, tail = path.rpartition("<")
            if head:
                return head
        return path

    def resolve(self, pid, path, dirfd_arg):
        if path is None:
            return None
        path = self.clean_ann(path)
        if path.startswith("/"):
            return os.path.normpath(path)
        base = self.cwd
        if dirfd_arg:
            # -yy renders the dirfd as  AT_FDCWD  or  3
            if dirfd_arg.startswith("AT_FDCWD"):
                m = re.match(r"AT_FDCWD<(?P[^>]*)>", dirfd_arg)
                if m:
                    base = m.group("path")
            else:
                m = FD_ANN_RE.match(dirfd_arg)
                if m and m.group("path").startswith("/"):
                    base = self.clean_ann(m.group("path"))
                elif dirfd_arg.split("<")[0].isdigit():
                    known = self.fds[pid].get(int(dirfd_arg.split("<")[0]))
                    if known and known.startswith("/"):
                        base = known
                    else:
                        return "%s   (relative to fd %s)" % (path, dirfd_arg)
        return os.path.normpath(os.path.join(base, path))

    def record_file(self, pid, path, klass, call, err):
        if not path:
            return
        rec = self.files.get(path)
        if rec is None:
            rec = self.files[path] = {
                "path": path, "classes": set(), "calls": collections.Counter(),
                "pids": set(), "errors": collections.Counter(), "count": 0,
            }
        rec["classes"].add(klass)
        rec["calls"][call] += 1
        rec["pids"].add(pid)
        rec["count"] += 1
        if err:
            rec["errors"][err] += 1

    # ---- main parse -------------------------------------------------------
    def feed(self, lines):
        pending = {}                                   # pid -> (call, args) unfinished
        for raw in lines:
            raw = raw.rstrip("\n")
            m = LINE_RE.match(raw)
            if m:
                pid, rest = int(m.group("pid")), m.group("rest")
            else:                                      # no -f: single process
                pid, rest = 0, raw.strip()
            rest = rest.strip()
            p = self.proc(pid)

            em = EXIT_RE.match(rest)
            if em:
                p.exit = int(em.group("code")); continue
            km = KILLED_RE.match(rest)
            if km:
                p.signal = km.group("sig"); continue
            if SIG_RE.match(rest) or rest.startswith("<... ") and "resumed>" not in rest:
                continue

            um = UNFINISHED_RE.match(rest)
            if um:
                pending[pid] = (um.group("call"), um.group("args"))
                continue
            rm = RESUMED_RE.match(rest)
            if rm:
                call, args0 = pending.pop(pid, (rm.group("call"), ""))
                tail = rm.group("rest")
                rest = "%s(%s%s" % (call, args0, tail if tail.startswith(",") or tail.lstrip().startswith(")") else " " + tail.lstrip())
                if ")" not in rest:
                    continue

            cm = CALL_RE.match(rest)
            if not cm:
                continue
            call = cm.group("call")
            args = split_args(cm.group("args"))
            ret = cm.group("ret")
            err = cm.group("err")
            p.syscalls[call] += 1
            if err:
                self.errors[err] += 1

            self.handle(pid, call, args, ret, cm.group("retann"), err)

    def handle(self, pid, call, args, ret, retann, err):
        # ---- process lifecycle -------------------------------------------
        if call in ("clone", "clone3", "fork", "vfork") and err is None and ret.isdigit():
            child = int(ret)
            c = self.proc(child)
            c.parent = pid
            # CLONE_THREAD means a new thread in the same process, not a new
            # process. A threaded daemon (httpd's event MPM, nginx, a JVM) makes
            # hundreds of these, and counting them as processes turns the tree
            # into noise and the process count into a lie.
            c.is_thread = "CLONE_THREAD" in " ".join(args)
            if c not in self.proc(pid).children:
                self.proc(pid).children.append(c)
            # a new task inherits the parent's fd table
            self.fds[child] = dict(self.fds[pid])
            return

        if call in ("execve", "execveat"):
            idx, dirfd_i, _ = PATH_CALLS[call]
            path = self.resolve(pid, unquote(args[idx]) if len(args) > idx else None,
                                args[dirfd_i] if dirfd_i is not None and len(args) > dirfd_i else None)
            argv = args[idx + 1] if len(args) > idx + 1 else ""
            if err is None:
                pr = self.proc(pid)
                pr.exe, pr.argv = path, argv
                if path and path not in pr.images:
                    pr.images.append(path)
                self.execs.append((pid, path, argv))
            self.record_file(pid, path, "exec", call, err)
            return

        # ---- network ------------------------------------------------------
        if call in NET_CALLS:
            detail = ", ".join(a for a in args[1:3]) if len(args) > 1 else (args[0] if args else "")
            if call == "socket":
                detail = ", ".join(args[:2])
            self.net.append((pid, call, detail[:160], err or ret))
            if call in ("bind", "connect", "sendto"):
                for a in args:
                    if "sun_path" in a:
                        sp = unquote(a)
                        if sp:
                            self.record_file(pid, self.resolve(pid, sp, None), "open", call, err)
            if call in ("socket", "accept", "accept4") and err is None and ret.isdigit():
                self.fds[pid][int(ret)] = retann.strip("<>") if retann else "socket"
            return

        # ---- path-based ---------------------------------------------------
        if call in PATH_CALLS:
            idx, dirfd_i, klass = PATH_CALLS[call]
            rawpath = unquote(args[idx]) if len(args) > idx else None
            dirfd = args[dirfd_i] if dirfd_i is not None and len(args) > dirfd_i else None
            path = self.resolve(pid, rawpath, dirfd)
            flags = args[idx + 1] if len(args) > idx + 1 else ""
            if klass == "open":
                if "O_WRONLY" in flags or "O_RDWR" in flags:
                    klass = "write"
                if "O_CREAT" in flags:
                    self.record_file(pid, path, "create", call, err)
            self.record_file(pid, path, klass, call, err)
            if err is None and ret.isdigit() and klass in ("open", "write", "create"):
                self.fds[pid][int(ret)] = self.clean_ann(retann.strip("<>")) if retann else path
            return

        # ---- fd-based ------------------------------------------------------
        if call in FD_CALLS:
            target = None
            for a in args:
                m = FD_ANN_RE.match(a)
                if m:
                    target = m.group("path"); break
            if target is None and args and args[0].isdigit():
                target = self.fds[pid].get(int(args[0]))
            if target:
                target = self.clean_ann(target)
            if target and not target.startswith(("socket:", "pipe:", "anon_inode:",
                                                 "TCP:", "UDP:", "UNIX:", "NETLINK:",
                                                 "inotify:", "eventpoll:", "signalfd:")):
                self.record_file(pid, self.resolve(pid, target, None), FD_CALLS[call], call, err)
            return

        if call == "close" and args and args[0].split("<")[0].isdigit():
            self.fds[pid].pop(int(args[0].split("<")[0]), None)


# --------------------------------------------------------------- reporting --
def classify_dir(path):
    for prefix in ("/etc", "/proc", "/sys", "/dev", "/tmp", "/var/tmp", "/var/log",
                   "/var/lib", "/var/run", "/run", "/usr/lib64", "/usr/lib",
                   "/usr/share", "/usr/bin", "/usr/sbin", "/home", "/root", "/opt"):
        if path == prefix or path.startswith(prefix + "/"):
            return prefix
    return os.path.dirname(path) or "(relative)"


def fmt_classes(classes):
    return ",".join(c for c in CLASS_ORDER if c in classes)


def md_table(header, rows):
    if not rows:
        return "_none_\n"
    out = ["| " + " | ".join(header) + " |",
           "|" + "|".join("---" for _ in header) + "|"]
    for r in rows:
        out.append("| " + " | ".join(str(c).replace("|", "\\|") for c in r) + " |")
    return "\n".join(out) + "\n"


def inherited_image(tr, p):
    """A forked child with no execve runs its parent's image; find which."""
    seen = set()
    cur = p
    while cur is not None and cur.pid not in seen:
        if cur.exe:
            return cur.exe
        seen.add(cur.pid)
        cur = tr.procs.get(cur.parent)
    return None


def proc_tree(tr):
    lines = []
    roots = [p for p in tr.procs.values() if p.parent is None or p.parent not in tr.procs]

    def walk(p, depth):
        if p.exe:
            who, argv = p.exe, (" " + p.argv) if p.argv else ""
        else:
            inh = inherited_image(tr, p)
            kind = "thread of pid %s" % p.parent if p.is_thread else "forked, no exec"
            who = "%s (%s)" % (inh, kind) if inh else "(image unknown, %s)" % kind
            argv = ""
        status = ("exit=%s" % p.exit) if p.exit is not None else (
            "killed by %s" % p.signal if p.signal else "status unknown")
        lines.append("%s- pid %d  %s%s  [%s, %d syscalls]" %
                     ("  " * depth, p.pid, who, argv[:120], status, sum(p.syscalls.values())))
        kids = sorted(p.children, key=lambda x: x.pid)
        procs = [c for c in kids if not c.is_thread]
        threads = [c for c in kids if c.is_thread]
        if threads:
            tids = ", ".join(str(t.pid) for t in threads[:8])
            more = "" if len(threads) <= 8 else ", +%d more" % (len(threads) - 8)
            lines.append("%s  +-- %d thread(s) in this process [tid %s%s]"
                         % ("  " * depth, len(threads), tids, more))
            # a thread that did real work is worth showing on its own
            for t in threads:
                if sum(t.syscalls.values()) >= 20 or t.children:
                    walk(t, depth + 1)
        for c in procs:
            walk(c, depth + 1)

    for r in sorted(roots, key=lambda x: x.pid):
        walk(r, 0)
    return "\n".join(lines) + "\n"


def report(tr, title, argv_line, csv_dir=None):
    files = sorted(tr.files.values(), key=lambda r: r["path"])
    written = [f for f in files if {"write", "create", "delete"} & f["classes"]]
    readonly = [f for f in files if f not in written]
    missing = [f for f in files if f["errors"].get("ENOENT")]
    execed = [f for f in files if "exec" in f["classes"]]
    libs = [f for f in files if f["path"].endswith(".so") or ".so." in f["path"]]

    o = []
    o.append("# %s\n" % title)
    o.append("Command traced: `%s`\n" % argv_line)
    o.append("## 1. Summary\n")
    o.append(md_table(
        ["metric", "value"],
        [["processes", sum(1 for p in tr.procs.values() if not p.is_thread)],
         ["threads (CLONE_THREAD)", sum(1 for p in tr.procs.values() if p.is_thread)],
         ["execve'd images", len(tr.execs)],
         ["distinct paths touched", len(files)],
         ["  of which written/created/deleted", len(written)],
         ["  of which read/stat only", len(readonly)],
         ["  of which shared libraries", len(libs)],
         ["  of which missing (ENOENT)", len(missing)],
         ["socket operations", len(tr.net)],
         ["failed syscalls", sum(tr.errors.values())]]))

    o.append("\n## 2. Process tree\n")
    o.append("```\n" + proc_tree(tr) + "```\n")
    o.append("\n### 2.1 Executed images\n")
    o.append(md_table(["pid", "program", "argv"],
                      [[p, path, (argv or "")[:110]] for p, path, argv in tr.execs]))

    o.append("\n## 3. Files written, created or deleted\n")
    o.append(md_table(["path", "access", "syscalls", "pids", "errors"],
                      [[f["path"], fmt_classes(f["classes"]),
                        ",".join("%s(%d)" % kv for kv in f["calls"].most_common(4)),
                        ",".join(str(x) for x in sorted(f["pids"])),
                        ",".join(f["errors"]) or "-"] for f in written]))

    o.append("\n## 4. Files read or inspected (read-only)\n")
    o.append(md_table(["path", "access", "syscalls", "pids", "errors"],
                      [[f["path"], fmt_classes(f["classes"]),
                        ",".join("%s(%d)" % kv for kv in f["calls"].most_common(4)),
                        ",".join(str(x) for x in sorted(f["pids"])),
                        ",".join(f["errors"]) or "-"] for f in readonly]))

    o.append("\n## 5. Paths probed but absent (ENOENT)\n")
    o.append("These reveal expected config/plugin locations - often the most telling part.\n\n")
    o.append(md_table(["path", "syscalls"],
                      [[f["path"], ",".join(f["calls"])] for f in missing]))

    o.append("\n## 6. Shared objects actually loaded at runtime\n")
    o.append("Compare with `ldd`: anything here that ldd did not list was `dlopen`ed.\n\n")
    o.append(md_table(["library", "access"],
                      [[f["path"], fmt_classes(f["classes"])] for f in libs]))

    o.append("\n## 7. Directory footprint\n")
    byd = collections.Counter()
    for f in files:
        byd[classify_dir(f["path"])] += 1
    o.append(md_table(["directory", "paths touched"], byd.most_common()))

    o.append("\n## 8. Socket / network activity\n")
    o.append(md_table(["pid", "call", "detail", "result"],
                      [[p, c, d, r] for p, c, d, r in tr.net]))

    o.append("\n## 9. Failed syscalls by errno\n")
    o.append(md_table(["errno", "count"], tr.errors.most_common()))

    o.append("\n## 10. Syscall profile per process\n")
    rows = []
    for pid, p in sorted(tr.procs.items()):
        if p.exe:
            img = p.exe
        else:
            inh = inherited_image(tr, p)
            img = ("%s (inherited)" % inh) if inh else "-"
        if p.is_thread:
            img += "  [thread]"
        rows.append([pid, img,
                     ", ".join("%s=%d" % kv for kv in p.syscalls.most_common(8))])
    o.append(md_table(["pid", "image", "top syscalls"], rows))

    if csv_dir:
        os.makedirs(csv_dir, exist_ok=True)
        with open(os.path.join(csv_dir, "files.csv"), "w", newline="") as fh:
            w = csv.writer(fh)
            w.writerow(["path", "access", "syscalls", "pids", "errors", "count"])
            for f in files:
                w.writerow([f["path"], fmt_classes(f["classes"]),
                            ";".join(f["calls"]), ";".join(str(x) for x in sorted(f["pids"])),
                            ";".join(f["errors"]), f["count"]])
        with open(os.path.join(csv_dir, "processes.csv"), "w", newline="") as fh:
            w = csv.writer(fh)
            w.writerow(["pid", "parent", "image", "argv", "exit", "signal", "syscalls",
                        "all_images", "kind"])
            for pid, p in sorted(tr.procs.items()):
                w.writerow([pid, p.parent or "", p.exe or "", p.argv or "",
                            p.exit if p.exit is not None else "", p.signal or "",
                            sum(p.syscalls.values()), ";".join(p.images),
                            "thread" if p.is_thread else "process"])
        with open(os.path.join(csv_dir, "network.csv"), "w", newline="") as fh:
            w = csv.writer(fh)
            w.writerow(["pid", "call", "detail", "result"])
            w.writerows(tr.net)
    return "\n".join(o)


def main():
    ap = argparse.ArgumentParser(description="Summarise an strace log: files, processes, sockets.")
    ap.add_argument("logfile", help="strace output file ('-' for stdin)")
    ap.add_argument("-o", "--output", help="write the Markdown report here (default: stdout)")
    ap.add_argument("-c", "--cwd", default=os.getcwd(),
                    help="working directory the traced program ran in (for relative paths)")
    ap.add_argument("-t", "--title", default="ELF runtime access report")
    ap.add_argument("--cmd", default="(unknown)", help="the command line that was traced")
    ap.add_argument("--csv-dir", help="also write files.csv / processes.csv / network.csv here")
    args = ap.parse_args()

    fh = sys.stdin if args.logfile == "-" else open(args.logfile, "r", errors="replace")
    tr = Trace(args.cwd)
    tr.feed(fh)
    if fh is not sys.stdin:
        fh.close()

    text = report(tr, args.title, args.cmd, args.csv_dir)
    if args.output:
        with open(args.output, "w") as out:
            out.write(text)
        print("report written: %s" % args.output, file=sys.stderr)
    else:
        sys.stdout.write(text)


if __name__ == "__main__":
    main()