Not every -1 in a trace is a breakage. strace options keep only the calls you need on the screen.
In the full nightsync trace, 35 file calls end with ENOENT. Nearly all of them come before the program's own first line: the loader and python3 look for libraries, settings and modules along several paths and take the first one found. Such a miss is normal work. What matters is the error after which the program exits.
The -e trace= option keeps calls of one kind, and -o writes the trace to a file instead of the screen:
Without the -f option strace follows only the process it started. A service often starts with a wrapper script, and the real program runs as its child process: strace shows the child's calls only with -f.
The admin created /etc/nightsync/sync.conf, but with mode 600 and owner root. How will the openat line for this file end now in strace run as student?
-
The file exists now, so there will be no ENOENT. Only root may read it, and the kernel will refuse student on permissions.
-
strace watches the process, not the file: the calls of a program you started are visible without sudo, and the kernel's refusal is in the call result.
-
Reading needs the r permission, and a 600 root file grants it to the owner only:
ls -lshows-rw-------.
The file exists, but student cannot read it: the kernel answers openat with EACCES. This is how strace tells “no file” from “no permission”, even when the program says nothing about either.
Key points
-
A failed system call is
-1plus the error name:ENOENT— no such file,EACCES— no permission. -
The cause of a silent failure is the last call with
-1before the exit; misses at the start are a search along paths. -
-e trace=keeps calls of one kind,-fadds child processes,-owrites to a file.