whytime 0.1.1

Added

• Published on crates.io: cargo install --locked whytime (needs clang with the BPF target
  and Rust 1.94 or newer). The internal crates whytime-abi and whytime-bpf are
  published alongside it, pinned to the same version.

Changed

• The trace file format changed (32-bit syscalls are recorded as such): whytime report
  refuses files recorded by 0.1.0 with exit status 2.

Security

• Under sudo, output files (--record, --perfetto, --flamegraph, --folded) are
  created with the invoking user's permissions. They were previously opened as root,
  following symlinks and truncating whatever file was there, then handed to the user.

Fixed

• whytime builds on glibc targets (x86_64 and aarch64 *-linux-gnu), not only musl.
• whytime no longer aborts (exit 134) when stderr is a closed pipe, as in
  whytime -- make 2>&1 | head.
• Control characters in process names, arguments and paths are escaped in the text report,
  and no longer make flamegraph SVGs invalid.
• Signals inherited as ignored (nohup, background jobs of non-interactive shells) stay
  ignored for COMMAND.
• The --perfetto path is checked before COMMAND runs, like the other output files,
  instead of failing after the run.
• Attach mode holds the target before checking its owner, so a PID reused in between can no
  longer be traced in its place.
• Misspelled options (--duraton 5) are rejected instead of being run as COMMAND.
• COMMAND no longer inherits a raised RLIMIT_MEMLOCK.
• The exit of a process whose last thread to exit is an io_uring SQPOLL or vhost worker is
  no longer missed.
• 32-bit (compat) syscalls of 32-bit programs are no longer misclassified as the 64-bit
  syscall with the same number.
• whytime doctor points to the verifier log (WHYTIME_LOG=debug) when the verifier
  rejects a program, instead of suggesting setcap or sudo.
• whytime loads on kernels built without IPv6.
• Host names are recovered from DNS over TCP as musl's resolver does it, and a TCP reply
  read in several pieces is no longer partly parsed as a new message.
• A wakeup or a ready descriptor recorded just as a thread blocked is no longer lost, which
  attributed the wait to its syscall instead of to its waker or the ready descriptor.
• Report time no longer grows quadratically or cubically with chains of threads handing
  work over to each other.
• Waits ended by a process outside the traced tree are no longer chained as timeouts.
• The waker of a wait is found after a non-leader thread calls exec.
• sync() and msync() no longer read a file descriptor from an unrelated register, which
  attributed them to an unrelated file.
• Crafted trace files whose traced process has no threads are rejected instead of aborting
  whytime report.

Install

Static binaries for x86_64 and aarch64 Linux (5.18 or newer, with BTF). Each tarball holds
the binary, LICENSE, THIRD_PARTY_LICENSES.md, README.md, shell completions and man
pages:

tag=v0.1.1
name=whytime-$tag-$(uname -m)-linux-musl         # x86_64 or aarch64
curl -fsSLO "https://github.com/Arinerron/whytime/releases/download/$tag/$name.tar.gz"
curl -fsSLO "https://github.com/Arinerron/whytime/releases/download/$tag/$name.tar.gz.sha256"
sha256sum -c "$name.tar.gz.sha256"
tar -xzf "$name.tar.gz"
sudo install -m 755 "$name/whytime" /usr/local/bin/whytime

Or build it from crates.io:

cargo install --locked whytime

This compiles whytime and its BPF objects on your machine, so it needs clang with the BPF
target (clang -print-targets | grep bpf; override with CLANG=) and Rust 1.94 or newer.
--locked uses the dependency versions whytime was released with. The result is a
dynamically linked glibc binary in ~/.cargo/bin (the release tarballs are static musl).
sudo whytime usually reports "command not found", because sudo's secure_path does not
include ~/.cargo/bin: run sudo "$(command -v whytime)" -- COMMAND, or grant the
capabilities to the binary instead (sudo setcap cap_bpf,cap_perfmon+ep ~/.cargo/bin/whytime).

Then run whytime doctor to check the system, and sudo whytime -- COMMAND. See the
README for privileges, usage and limits.