linux-kernel - Re: [PATCH v2 1/2] perf: add container identifier entry in perf sample data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Sep 2016 11:09:41 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Hari Bathini <hbathini@...ux.vnet.ibm.com>
Cc:     ast@...com, lkml <linux-kernel@...r.kernel.org>, acme@...nel.org,
        alexander.shishkin@...ux.intel.com, mingo@...hat.com,
        daniel@...earbox.net, rostedt@...dmis.org,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        ebiederm@...ssion.com, sargun@...gun.me,
        Aravinda Prasad <aravinda@...ux.vnet.ibm.com>,
        brendan.d.gregg@...il.com
Subject: Re: [PATCH v2 1/2] perf: add container identifier entry in perf
 sample data

On Tue, Aug 30, 2016 at 09:57:02PM +0530, Hari Bathini wrote:
> Currently, there is no mechanism to filter events based on containers.
> perf -G can be used, but it will not filter events for the containers
> created after perf is invoked, making it difficult to assess/analyze
> performance issues of multiple containers at once. This limitation can
> be overcome, if there is a standard kernel identifier for containers.
> 
> This patch introduces a container identifier entry field in perf sample
> data to identify or distinguish sample data of different containers. It
> uses the cgroup namespace inode number of a given task as it's container
> identifier (cid). Alternatively, inode number of pid namespace can also
> be used as cid. This patch assumes each container is created with it's
> own cgroup namespace.

I'm thinking this value is mostly the same for tasks, just like COMM and
MMAP. Could we therefore not emit (sideband) events whenever a task
changes namespace and get the same information but with tons less data?

That also gives the possibility of recording all namespaces, not just
the one.