linux-kernel - Re: [PACTH v1] trace: Add trace events for open(), exec() and uselib()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 1 Aug 2016 13:44:53 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	robert.foss@...labora.com
Cc:	viro@...iv.linux.org.uk, mingo@...hat.com, scott@...ntu.com,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PACTH v1] trace: Add trace events for open(), exec() and
 uselib()

On Mon,  1 Aug 2016 13:25:40 -0400
robert.foss@...labora.com wrote:

> From: Scott James Remnant <scott@...ntu.com>
> 
> This patch uses TRACE_EVENT to add tracepoints for the open(),
> exec() and uselib() syscalls so that ureadahead can cheaply trace
> the boot sequence to determine what to read to speed up the next.
> 

Good luck. AFAIK, Viro refuses to have tracepoints in the vfs subsystem.

-- Steve

> Signed-off-by: Scott James Remnant <scott@...ntu.com>
> Tested-by: Robert Foss <robert.foss@...labora.com>
> Signed-off-by: Robert Foss <robert.foss@...labora.com>
> ---
>  fs/exec.c                 |  7 ++++++-
>  fs/open.c                 |  4 ++++
>  include/trace/events/fs.h | 53 +++++++++++++++++++++++++++++++++++++++++++++++
>  3 files changed, 63 insertions(+), 1 deletion(-)
>  create mode 100644 include/trace/events/fs.h
> 
> diff --git a/fs/exec.c b/fs/exec.c
> index 887c1c9..123b257 100644
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -58,6 +58,8 @@
>  #include <linux/compat.h>
>  #include <linux/vmalloc.h>
>  
> +#include <trace/events/fs.h>
> +
>  #include <asm/uaccess.h>
>  #include <asm/mmu_context.h>
>  #include <asm/tlb.h>
> @@ -797,9 +799,12 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags)
>  	if (err)
>  		goto exit;
>  
> -	if (name->name[0] != '\0')
> +	if (name->name[0] != '\0') {
>  		fsnotify_open(file);
>  
> +		trace_open_exec(name->name);
> +	}
> +
>  out:
>  	return file;
>  
> diff --git a/fs/open.c b/fs/open.c
> index 93ae3cd..2ec0680 100644
> --- a/fs/open.c
> +++ b/fs/open.c
> @@ -34,6 +34,9 @@
>  
>  #include "internal.h"
>  
> +#define CREATE_TRACE_POINTS
> +#include <trace/events/fs.h>
> +
>  int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
>  	struct file *filp)
>  {
> @@ -1020,6 +1023,7 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
>  		} else {
>  			fsnotify_open(f);
>  			fd_install(fd, f);
> +			trace_do_sys_open(tmp->name, flags, mode);
>  		}
>  	}
>  	putname(tmp);
> diff --git a/include/trace/events/fs.h b/include/trace/events/fs.h
> new file mode 100644
> index 0000000..fb634b7
> --- /dev/null
> +++ b/include/trace/events/fs.h
> @@ -0,0 +1,53 @@
> +#undef TRACE_SYSTEM
> +#define TRACE_SYSTEM fs
> +
> +#if !defined(_TRACE_FS_H) || defined(TRACE_HEADER_MULTI_READ)
> +#define _TRACE_FS_H
> +
> +#include <linux/fs.h>
> +#include <linux/tracepoint.h>
> +
> +TRACE_EVENT(do_sys_open,
> +
> +	TP_PROTO(const char *filename, int flags, int mode),
> +
> +	TP_ARGS(filename, flags, mode),
> +
> +	TP_STRUCT__entry(
> +		__string(	filename, filename		)
> +		__field(	int, flags			)
> +		__field(	int, mode			)
> +	),
> +
> +	TP_fast_assign(
> +		__assign_str(filename, filename);
> +		__entry->flags = flags;
> +		__entry->mode = mode;
> +	),
> +
> +	TP_printk("\"%s\" %x %o",
> +		  __get_str(filename), __entry->flags, __entry->mode)
> +);
> +
> +TRACE_EVENT(open_exec,
> +
> +	TP_PROTO(const char *filename),
> +
> +	TP_ARGS(filename),
> +
> +	TP_STRUCT__entry(
> +		__string(	filename, filename		)
> +	),
> +
> +	TP_fast_assign(
> +		__assign_str(filename, filename);
> +	),
> +
> +	TP_printk("\"%s\"",
> +		  __get_str(filename))
> +);
> +
> +#endif /* _TRACE_FS_H */
> +
> +/* This part must be outside protection */
> +#include <trace/define_trace.h>