SUBTERFUGUE: Using Python to Monitor and Script the Linux Kernel

SUBTERFUGUE is kind of like a Python scripting interface for Linux kernel internals. It can follow, rewrite and annul system calls, signals, process trees, fork, vfork and clone.

Very cool, experimental stuff.

SUBTERFUGUE is a framework for observing and playing with the reality of software; it's a foundation for building tools to do tracing, sandboxing, and many other things. You could think of it as "strace meets expect."

This is done with tricks, which are components that watch and possibly modify a program's actions for a specific purpose.

SUBTERFUGUE comes with several tricks. One, called Trace, watches a program and produces output similar to strace(1). Another, ThrottleIO, restricts the total (average) I/O rate of a process. The most substantial trick, SimplePathSandbox, restricts the parts of the filesystem that a process (and its progeny) are allowed to read to and write from.

Tricks can generally be composed to produce a combined effect. So, for example, ThrottleIO could be combined with SimplePathSandbox to restrict I/O rate and path access, or a SimplePathSandbox could be sandwiched between two Trace tricks in order to observe the changes in the flow of system calls that SimplePathSandbox is making. Some trick combinations will not work, though, because they have contrary purposes or interfering implementations.