This behaviour was verified by reading the kernel source and confirming the behaviour using a test program. Applies to latest git repo. Kind regards, James. -- James Hunt ____________________________________ http://upstart.ubuntu.com/cookbook http://upstart.ubuntu.com/cookbook/upstart_cookbook.pdf
>From 44d1bffe6dfbaeaae3e0bafb7ec626eb362f97e2 Mon Sep 17 00:00:00 2001 From: James Hunt <james.hunt@xxxxxxxxxx> Date: Thu, 13 Sep 2012 21:53:18 +0100 Subject: Explain behaviour should ptrace tracer call execve. --- man2/ptrace.2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/man2/ptrace.2 b/man2/ptrace.2 index c45e569..d051358 100644 --- a/man2/ptrace.2 +++ b/man2/ptrace.2 @@ -1660,6 +1660,9 @@ In Linux kernels before 2.6.26, .BR init (8), the process with PID 1, may not be traced. .LP +A tracees parent continues to be the tracer even if that tracer calls +.BR execve (2). +.LP The layout of the contents of memory and the USER area are quite operating-system- and architecture-specific. The offset supplied, and the data returned, -- 1.7.9.5
