lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 18 May 2012 16:11:07 -0700 From: "Kok, Auke-jan H" <auke-jan.h.kok@...el.com> To: Serge Hallyn <serge.hallyn@...onical.com> Cc: linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org, Eric Paris <eparis@...hat.com> Subject: Re: [PATCH] Trace event for capable(). On Fri, May 18, 2012 at 3:25 PM, Serge Hallyn <serge.hallyn@...onical.com> wrote: > Quoting Auke Kok (auke-jan.h.kok@...el.com): >> Add a simple trace event for capable(). >> >> There's been a lot of discussion around capable(), and there >> are plenty of tools to help reduce capabilities' usage from >> userspace. A major gap however is that it's almost impossible >> to see or verify which bits are requested from either userspace >> or in the kernel. >> >> This patch adds a minimal tracer that will print out which >> CAPs are requested and whether the request was granted. >> >> Signed-off-by: Auke Kok <auke-jan.h.kok@...el.com> >> Cc: linux-security-module@...r.kernel.org >> Cc: linux-kernel@...r.kernel.org >> Cc: Serge Hallyn <serge.hallyn@...onical.com> > > Hi, > > is there any measurable performance impact by this patch? (Have you > measured it?) I actually did a full OS boot test and didn't see a noticeable difference - basically booted with init=/bin/bash, mount debugfs, start the tracer and then exec /sbin/init... It's anecdotal, but, given the use of this tracer should be more than acceptable. Of course, there is a small (nop - ~1 cycle) penalty to the tracepoint even if tracing is disabled, but the codepath should never be in any form of hotpath no matter what, since any call to capable() will end up in LSM checks and audit checks anyway. > I'm not familiar enough with the tracing stuff, but if the tracing is > done so there's no impact when not tracing, then I have no problem with > this. It could be quite useful as you say. > > Acked-by: Serge Hallyn <serge.hallyn@...ntu.com> thanks, - I might resend a new patch if I can add the namespace info as per the other comment. Auke -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists