linux-kernel - Re: [PATCH 0/7] utrace/ptrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091223174232.GA14993@redhat.com>
Date:	Wed, 23 Dec 2009 18:42:32 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Alexey Dobriyan <adobriyan@...il.com>,
	Andi Kleen <andi@...stfloor.org>,
	Ananth Mavinakayanahalli <ananth@...ibm.com>,
	Christoph Hellwig <hch@...radead.org>,
	"Frank Ch. Eigler" <fche@...hat.com>, Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <peterz@...radead.org>,
	Roland McGrath <roland@...hat.com>,
	linux-kernel@...r.kernel.org, utrace-devel@...hat.com
Subject: Re: [PATCH 0/7] utrace/ptrace

On 12/22, Andrew Morton wrote:
>
> On Fri, 18 Dec 2009 02:11:16 +0100
> Oleg Nesterov <oleg@...hat.com> wrote:
>
> > It allows for multiple separate tracing engines to work
> > in parallel without interfering with each other.  Higher-level tracing
> > facilities can be implemented as loadable kernel modules using this layer.
>
> That's a bit brief.  Do you have a nicer sales brochure?  What are
> these "separate tracing engines" and what is their merge status and why
> would we want any of them, for what purpose?  etc.
>
> IOW: give us a reason!

First of all, utrace makes other things possible. gdbstub, nondestructive
core dump, uprobes, kmview, hopefully more. I didn't look at these projects
closely, perhaps other people can tell more. As for their merge status,
until utrace itself is merged it is very hard to develop them out of tree.

To me, even seccomp is the good example why utrace is useful. seccomp
is simple, but it needs hooks in arch/ hot pathes. Contrary, utrace-based
implementation is more flexible, simple, and it is completely "hidden"
behind utrace.

In my opinion, ptrace-utrace is another example. Once CONFIG_UTRACE
goes away, we can remove almost all ptrace-related code from core
kernel (and kill task_struct->ptrace/etc members).

ftrace/etc is excellent in many ways, but even if we need the simple
"passive" tracing it is not enough sometimes. And we have nothing else
except ptrace currently. But ptrace is so horrible and unfixeable, and
it has so many limitations. In fact, even the simple things like stop/
continue this thread/process are not trivial using ptrace, gdb/strace
have to do a lot of hacks to overcome ptrace's limitations, and some
of these hacks falls into "mostly works, but that is all" category.

Of course, I can't promise we will have the new gdb which explores
utrace facilities soon, but I think at leat utrace gives a chance.

Well. I had a lot of technical discussions with Roland about utrace,
but I never asked him why he created this thing ;) To me, utrace
looks like vfs. Currently we have the single and very poor "filesystem",
ptrace. Until we add the appropriate layer, we can't expect the
further improvements is this area.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/