Here are strace outputs per process.

strace_output.22076 is the plugin's pid. (A little before forking)
strace_output.22077  runs qemu-img
strace_output.22078 is a mystery to me
strace_output.22079 is rm -rf to the overlay image and its temporary dir.

Best Regards,
Peter


On Wed, Nov 7, 2018 at 4:38 PM Richard W.M. Jones <rjones@redhat.com> wrote:
On Wed, Nov 07, 2018 at 01:37:03PM +0200, Peter Dimitrov wrote:
> > That makes no sense because we are supposed to have just forked
> successfully
>
> I just realized libguestfs uses fork. Now we know why qemu-img worked - I
> launched it with popen.
>
> > So it must be something to do with collectd and how it runs programs.
> > Is it using LD_PRELOAD trickery, or replacing libc, or using seccomp?
>
> If I understand the question correctly - it's about how collectd loads its
> plugins? If so it uses:
>
> static int plugin_load_file(const char *file, _Bool global) {
>   void (*reg_handle)(void);
>   int flags = RTLD_NOW;
>     if (global)
>       flags |= RTLD_GLOBAL;
>   void *dlh = *dlopen*(file, flags);
>   //...
>   reg_handle = (void (*)(void))*dlsym*(dlh, "module_register");
>   //...
>   *(*reg_handle)();*
> }
>
>
> Does this give any clues?

Can you strace the collectd process around the point where qemu-img is
run?  It may gives some clues.

Rich.

--
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
libguestfs lets you edit virtual machines.  Supports shell scripting,
bindings from many languages.  http://libguestfs.org