From ericsalem at gmail.com  Sun Jan  4 02:17:49 2026
From: ericsalem at gmail.com (Eric Salem)
Date: Sat, 3 Jan 2026 20:17:49 -0600
Subject: Why does strace print the wrong command name?
Message-ID: <5c3741b1-304a-441f-b85f-9815381adfd2@gmail.com>

Hi all,

I've noticed some strange behavior when printing the command name.

$ strace -e execve,write --always-show-pid -Y --status=successful cat /proc/self/comm > /dev/null
293961<strace> execve("/usr/bin/cat", ["cat", "/proc/self/comm"], 0x7ffc43e33330 /* 62 vars */) = 0
293961<cat> write(1, "cat\n", 4)        = 4
293961<cat> +++ exited with 0 +++

Works as expected.

$ strace -e execve,write --always-show-pid -Y --status=successful env cat /proc/self/comm > /dev/null
293976<strace> execve("/usr/bin/env", ["env", "cat", "/proc/self/comm"], 0x7fff8258ad08 /* 62 vars */) = 0
293976<env> execve("/usr/bin/cat", ["cat", "/proc/self/comm"], 0x7fffdf4fb378 /* 62 vars */) = 0
293976<env> write(1, "cat\n", 4)        = 4
293976<env> +++ exited with 0 +++

Does not. It still prints "env" as the command name after the second
execve().

Adding some debugging to src/syscall.c:syscall_exiting_decode() reveals
that syserror(tcp) is 1. Since the error flag is true, the command name
isn't updated. I'm not sure why the execve() call in the second case is
flagged as an error despite strace printing the return value of 0.

$ strace -V
strace -- version 6.18.0.9.4e0e
Copyright (c) 1991-2025 The strace developers <https://strace.io>.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Optional features enabled: stack-trace=libdw stack-demangle m32-mpers mx32-mpers secontext

Any ideas?

Thanks,

Eric