Jason R. Coombs added the comment:
I thought I was on to something when I found this technique for using dtrace to
detect a file deletion:
https://blogs.oracle.com/zoneszone/entry/who_keeps_removing_that_file
However, I don't seem to have privilege to run it.
$ cat trap-aliases-delete
#! /usr/sbin/dtrace -wqs
syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) ==
"/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/encodings/aliases.py"/
{
stop();
printf("%s[%d] caught removing aliases.py\n", execname, pid);
system("ptree %d; pstack %d; prun %d", pid, pid, pid);
}
$ sudo ./trap-aliases-delete
dtrace: system integrity protection is on, some features will not be available
dtrace: could not enable tracing: Permission denied
----------
_______________________________________
Python tracker <rep...@bugs.python.org>
<http://bugs.python.org/issue28949>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
