snaketrace's Introduction

SnakeTrace 🐍

An strace-like tool for Python audit events.

Requirements

Python 3.8 or later

Installation

Latest release via pip:

pip install snaketrace [--user]

via Git:

git clone https://github.com/dcoles/snaketrace.git; cd snaketrace
python3 setup.py install [--user]

Usage

usage: snaketrace [-h] [--tsv] [--color {never,always,auto}] [-t | -tt | --timefmt TIMEFMT] [-e FILTER]
                  [-o OUTPUT]
                  script [args [args ...]]

Trace Python audit events

positional arguments:
  script                Python script
  args                  Python script arguments

optional arguments:
  -h, --help            show this help message and exit
  --tsv                 output as tab separated values
  --color {never,always,auto}
                        colorize output
  -t                    print absolute timestamp
  -tt                   print absolute timestamp with usec
  --timefmt TIMEFMT     print absolute timestamp with custom format
  -e FILTER, --filter FILTER
                        filter audit events matching glob pattern (may be specified multiple times)
  -o OUTPUT, --output OUTPUT
                        write output to file with given name

License

Licensed under the MIT License.

snaketrace's People

Contributors

Stargazers

Watchers

snaketrace's Issues

import _pickle

Same versions on Linux -> same symptom

PS ~/upstream/snaketrace> python --version
Python 3.9.0a5
PS ~/upstream/snaketrace> git describe --tags
v0.3.0-1-gdcf6ba4
PS ~/upstream/snaketrace> echo "from _pickle import PickleBuffer" > py.py
PS ~/upstream/snaketrace> python -m snaketrace py.py
open('py.py', 'r', 32896)
open('C:\Users\e.medve\upstream\snaketrace\py.py', 'r', 32896)
open('C:\Users\e.medve\upstream\snaketrace\py.py', 'r', 32896)
compile(b'from _pickle import PickleBuffer\r\n', 'py.py')
exec(<code object at 0x000001A08D2C3EA0, file "py.py", line 1>)
import('_pickle', None, ['C:\Users\e.medve\upstream\snaketrace', 'C:\Program Files\Python3\python39.zip', 'C:\Program Files\Python3\DLLs', 'C:\Program Files\Python3\lib', 'C:\Program Files\Python3', 'C:\Program Files\Python3\lib\site-packages'], [<class '_frozen_importlib.BuiltinImporter'>, <class '_frozen_importlib.FrozenImporter'>, <class '_frozen_importlib_external.PathFinder'>], [<class 'zipimport.zipimporter'>, <function FileFinder.path_hook..path_hook_for_FileFinder at 0x000001A08B141D30>])
import('_compat_pickle', None, ['C:\Users\e.medve\upstream\snaketrace', 'C:\Program Files\Python3\python39.zip', 'C:\Program Files\Python3\DLLs', 'C:\Program Files\Python3\lib', 'C:\Program Files\Python3', 'C:\Program Files\Python3\lib\site-packages'], [<class '_frozen_importlib.BuiltinImporter'>, <class '_frozen_importlib.FrozenImporter'>, <class '_frozen_importlib_external.PathFinder'>], [<class 'zipimport.zipimporter'>, <function FileFinder.path_hook..path_hook_for_FileFinder at 0x000001A08B141D30>])
open('C:\Program Files\Python3\lib\pycache\compat_pickle.cpython-39.pyc', 'r', 32896)
exec(<code object at 0x000001A08D2CB240, file "C:\Program Files\Python3\lib_compat_pickle.py", line 9>)
builtins.id(1789074909600)
open('C:\Users\e.medve\upstream\snaketrace\snaketrace\trace.py', 'r', 32896)
open('C:\Program Files\Python3\lib\runpy.py', 'r', 32896)
open('py.py', 'r', 32896)
Traceback (most recent call last):
File "C:\Users\e.medve\upstream\snaketrace\snaketrace\trace.py", line 71, in trace
runpy.run_path(name, globals, run_name='main')
File "C:\Program Files\Python3\lib\runpy.py", line 265, in run_path
return _run_module_code(code, init_globals, run_name,
File "C:\Program Files\Python3\lib\runpy.py", line 97, in _run_module_code
_run_code(code, mod_globals, init_globals,
File "C:\Program Files\Python3\lib\runpy.py", line 87, in _run_code
exec(code, run_globals)
File "py.py", line 1, in
from _pickle import PickleBuffer
KeyError: '_compat_pickle'
cpython._PySys_ClearAuditHooks()

`import` events missing for modules used by snaketrace

This can be reproduced with the following Python script:

import argparse
import ctypes
import sys
import fnmatch
import io

import glob

$ snaketrace -e import test.py 
import('glob', None, …)

Expected behaviour:

$ snaketrace -e import test.py 
import('argparse', None, …)
import('ctypes', None, …)
import('sys', None, …)
import('fnmatch', None, …)
import('io', None, …)
import('glob', None, …)