linux-kernel - Re: [PATCH] Trace event for capable().

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CABsxX9+Tt5Ey0qpUWqS7beVOCiBzWtSDGU+Bd2KiN=07Bkm3SA@mail.gmail.com>
Date:	Fri, 18 May 2012 16:11:07 -0700
From:	"Kok, Auke-jan H" <auke-jan.h.kok@...el.com>
To:	Serge Hallyn <serge.hallyn@...onical.com>
Cc:	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, Eric Paris <eparis@...hat.com>
Subject: Re: [PATCH] Trace event for capable().

On Fri, May 18, 2012 at 3:25 PM, Serge Hallyn
<serge.hallyn@...onical.com> wrote:
> Quoting Auke Kok (auke-jan.h.kok@...el.com):
>> Add a simple trace event for capable().
>>
>> There's been a lot of discussion around capable(), and there
>> are plenty of tools to help reduce capabilities' usage from
>> userspace. A major gap however is that it's almost impossible
>> to see or verify which bits are requested from either userspace
>> or in the kernel.
>>
>> This patch adds a minimal tracer that will print out which
>> CAPs are requested and whether the request was granted.
>>
>> Signed-off-by: Auke Kok <auke-jan.h.kok@...el.com>
>> Cc: linux-security-module@...r.kernel.org
>> Cc: linux-kernel@...r.kernel.org
>> Cc: Serge Hallyn <serge.hallyn@...onical.com>
>
> Hi,
>
> is there any measurable performance impact by this patch?  (Have you
> measured it?)

I actually did a full OS boot test and didn't see a noticeable
difference - basically
 booted with init=/bin/bash, mount debugfs, start the tracer and then
exec /sbin/init...
It's anecdotal, but, given the use of this tracer should be more than
acceptable.

Of course, there is a small (nop - ~1 cycle) penalty to the tracepoint
even if tracing
is disabled, but the codepath should never be in any form of hotpath no matter
what, since any call to capable() will end up in LSM checks and audit
checks anyway.

> I'm not familiar enough with the tracing stuff, but if the tracing is
> done so there's no impact when not tracing, then I have no problem with
> this.  It could be quite useful as you say.
>
> Acked-by: Serge Hallyn <serge.hallyn@...ntu.com>

thanks, - I might resend a new patch if I can add the namespace info
as per the other comment.

Auke
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/