hexec - a process execution hooking tool
hexec <OPTIONS> [expr] [cmd] [args...]
hexec is a tool to hook into process exececution calls (exec
family of syscalls). You can define an expression that is executed against
any hooked exec call. This expression may also contain a replacement exec
call.
Here is a summary of the options to hexec.
--help | -h Print a options/expr summary page
--version | -v Print hexec version
--log-out | -lo set output file for error and -print output
- -h
- Print a options/expr summary page
- --help
- Print a options/expr summary page
- -lo
- Set the output file for error and -print output. This can be required if
writing to stderr could cause malfunction because some processes read from
stderr and expect a well defined output.
The expression is executed against all process execution calls. If
the expression returns true, the original call is skipped.
- <expr> -and <expr>
- <expr> -a <expr>
- <expr> <expr>
- Returns true if both expressions return true. If the left returns false,
the right expression is never executed.
- <expr> -or <expr>
- <expr> -o <expr>
- Returns true if one of both expressions returns true. If the left returns
true, the right expression is never executed.
- -path
<pattern>
- Returns true if the path of the executable matches <pattern>.
<pattern> is a bash compatible wild card pattern.
- -ipath
<pattern>
- Same as -path, but case insensitive.
- -name
<pattern>
- Returns true if the base name of the executable matches <pattern>.
<pattern> is a bash compatible wild card pattern.
- -iname
<pattern>
- Same as -name, but case insensitive.
- -contains
<str>
- Returns true if the path of the executable containes the string
<str>.
- -icontains
<str>
- Same as -contains, but case insensitive.
- -print
- Print all arguments to the called process. Returns always true.
- -exec <cmd> [args...]
;
- Executes <cmd> with [args...] as arguments. This expression must be
terminated with a semicolon. You can use argument placeholders in
<cmd> and [args...] (see below). This expression always returns
true.
NOTE: Please be aware that you may need to escape or quote the
terminating semicolon to not confuse your shell.
- -sh <script>
- Interprets <script> as a shell script by invoking /bin/sh with the
arguments -c '<script>'. You can use argument placeholders
inside <script>. Please note that -sh only expects a single argument
and not a variable list of arguments (as -exec does). Using -sh is the
same as using -exec sh -c <script>.
Every -exec expression can use placeholders in the argument list
to obtain information from the original exec call. Each placeholder starts
with { and ends with }. Use \{ if you want to use a { in your argument list.
The placeholders are replaced when the -exec expression is evaluated.
Placeholder types:
- {n}
- Will be replaced with the number of arguments in the original call.
- {<idx>}
- Will be replaced with the original argument at index <idx>. Example:
{1} would give the first argument. You can prepend <idx> with
placeholder flags.
- {}
- Will be replaced with all arguments from the original call. Each argument
is seperated with a space. You can use placeholder flags.
NOTE: The executable name is also considered as argument.
This means that a call like "echo test" will result in two
arguments, "echo" and "test".
hexec will add some environment variables to the hooked processes.
These are (may not be complete):
- LD_PRELOAD
- hexec adds libhexec-hook.so to the list of preloaded libraries.
- HEXEC_EXPR_SHM
- Contains the name of the internal shared memory object.
- HEXEC_LOG_FD
- Contains the file descriptor for error and -print output.
Please do never modify these environment variables. Also take care
when you use these variables, because the name and content of the variables
may change in the future.
- hexec -name 'gcc' -exec
ccache {s} \; make
- Calls make, which will then call gcc several times. The executable name of
each hooked process execution is tested against the file pattern
"gcc" and "ccache {s}" is called each time a match is
found. '{s}' will be replaced with the original (the hooked) call. In this
example, a call to "gcc -o test.o test.c" would be replaced with
"ccache gcc -o test.o test.c"
I'm sure there are alot...it's still beta :)
hexec was written by Alexander Block http://blocksoftware.net/
If you wish to report a problem or make a suggestion then please
email ablock@blocksoftware.net
hexec is released under the GNU General Public License version 2
or later. Please see the file COPYING for license details.