linux-kernel - Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 18:28:29 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Namhyung Kim <namhyung@...nel.org>, Ingo Molnar <mingo@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, kernel-team@....com
Subject: Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

On Fri, 31 Mar 2017 07:25:50 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> On Thu, 30 Mar 2017 09:49:29 -0400
> Steven Rostedt <rostedt@...dmis.org> wrote:
> 
> > On Thu, 30 Mar 2017 10:40:46 +0900
> > Namhyung Kim <namhyung@...nel.org> wrote:
> >   
> > > Hi Masami,
> > > 
> > > On Thu, Mar 30, 2017 at 9:54 AM, Masami Hiramatsu <mhiramat@...nel.org> wrote:  
> > > > On Wed, 29 Mar 2017 10:46:21 +0900
> > > > Namhyung Kim <namhyung@...nel.org> wrote:
> > > >    
> > > >> Hello,
> > > >>
> > > >> This patchset add 'function-fork' option to function tracer which
> > > >> makes pid filter to be inherited like 'event-fork' does.  During the
> > > >> test, I found a bug of pid filter on an instance directory.  The patch
> > > >> 1 fixes it and maybe it should go to the stable tree.
> > > >>
> > > >> The function-fork option is disabled by default as event-fork does,
> > > >> but we might consider changing the default since it seems to be more
> > > >> natural from an user's perspective IMHO.    
> > > >
> > > > By the way, I thought that event-fork option also effected to
> > > > function tracer. Is there any reason we should separate those?
> > > > I mean, we can add "trace-fork" option instead of "function-fork"
> > > > for setting both pid filters at once.
> > > >
> > > > Thank you,    
> > > 
> > > I'm ok with combining two options.
> > >  
> > 
> > I prefer not. Mainly because they are two different mechanisms, and
> > only event-fork is available now.  
> 
> That sounds like implementation issue. From the viewpoint of users,
> they may want to use just one knob to filter both. And I didn't
> suggest replacing event-fork, but adding trace-fork for both, like a
> superset option.

Well, trace-cmd will just set both when one adds -c

I'd like to have two options for now. We can always add a superset
option for later.

-- Steve

> 
> > trace-cmd will use ptrace if function
> > fork is needed. Having it separate will let trace-cmd know if it needs
> > to use ptrace or not for function forking.  
> 
> Yeah, that's a good workaround for older kernel.