[DTrace-devel] [PATCH] libproc: make Psystem_daemon() detect modern systemd properly

[Nick Alcock]

On 29 Jun 2025, Eugene Loh via DTrace-devel outgrape:

> I tested the patch and here is what I found:
>
>     OL7  UEK6     (I'm ignoring)
>     OL8  UEK6     regression!!!
>     OL8  UEK7     (never had a problem)
>     OL9  UEK7     issue fixed
>     OL9  UEK8     issue fixed
>     OL10 UEK8     issue fixed
>
> So why is there a regression for OL8/UEK6?
>
> We call Psystem_daemon(pid, useruid, ":/system.slice/"), where we start reading /proc/$pid/cgroup.

... actually, hang on...

> We used to look for a line that had ":name=systemd:" in it.
> So we found "1:name=systemd:/user.slice/user-1000.slice/session-35.scope".
> Going to the second colon, we see ":/user.slice/...",
> which does not match ":/system.slice/".
> So we decide the process is not a system daemon.
> This allows us to trace the process.
>
> With the patch, we look for a line that has ".slice/" in it.
> So we find "11:devices:/system.slice/sshd.service".

Oh... dammit, this is the old v1 multi-cgroup horror show. I thought
that was stone-cold dead, even on OL8, and looked and couldn't find any
daemons that were in more than one cgroup in any case (God knows what I
looked at: I can't find any which aren't, now).

Looks like we want to say that *if* there is a line with "name=systemd"
in it, we should use that line, but otherwise follow the new rules, and
pick the first (and only) line with a system.slice in it.

I'll implement that, and test it on OL7/OL8 as well (I'm sure I did, but
I can't have done... or maybe I tested OL7 and missed OL8.)