linux-kernel - Re: [PATCH -tip v5 4/7] tracing: add kprobe-based event tracer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090511105337.GF4648@elte.hu>
Date:	Mon, 11 May 2009 12:53:37 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Christoph Hellwig <hch@...radead.org>
Cc:	Masami Hiramatsu <mhiramat@...hat.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	lkml <linux-kernel@...r.kernel.org>,
	systemtap <systemtap@...rces.redhat.com>,
	kvm <kvm@...r.kernel.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Tom Zanussi <tzanussi@...il.com>
Subject: Re: [PATCH -tip v5 4/7] tracing: add kprobe-based event tracer


* Christoph Hellwig <hch@...radead.org> wrote:

> On Fri, May 08, 2009 at 08:48:59PM -0400, Masami Hiramatsu wrote:
> > Add kprobes based event tracer on ftrace.
> > 
> > This tracer is similar to the events tracer which is based on 
> > Tracepoint infrastructure. Instead of Tracepoint, this tracer is 
> > based on kprobes(kprobe and kretprobe). It probes anywhere where 
> > kprobes can probe(this means, all functions body except for 
> > __kprobes functions).
> 
> That's some pretty cool functionality, especially together with 
> patch 7.

Yes. I insisted on this model, because this is essentially 
kprobes-done-right. Exposing unsafe kernel instrumentation APIs was 
a big mistake to merge upstream, it delayed the proper design of 
this stuff by almost a decade.

There's two more details to be solved before this can go into the 
tracing tree.

> But as with so many tracing bits in the kernel it's just lowlevel 
> bits without a good user interface.  We'd really need some 
> high-level way for sysadmins/developers to use it.  E.g. a version 
> of the systemtap compiler that doesn't build a kernel module but 
> instead uses the event tracer + the kprobes tracer.

Yes, exactly.

> Or a model like Tom's zedtrace where a perl script would do the 
> dwarf lookups and generates these probes in addition to the 
> filtered event traces.

Correct, that's the other, IMHO superior direction that is being 
pursued. If you look at the evolution of the filter code it gives 
the seeds for safe scripting done in the kernel.

Such filters/scripts can then be reused for a whole lot more stuff, 
such as security rules. (netfilters could use it too, etc.)

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/