linux-kernel - Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 31 Mar 2017 07:25:50 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Namhyung Kim <namhyung@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, kernel-team@....com
Subject: Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

On Thu, 30 Mar 2017 09:49:29 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Thu, 30 Mar 2017 10:40:46 +0900
> Namhyung Kim <namhyung@...nel.org> wrote:
> 
> > Hi Masami,
> > 
> > On Thu, Mar 30, 2017 at 9:54 AM, Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > > On Wed, 29 Mar 2017 10:46:21 +0900
> > > Namhyung Kim <namhyung@...nel.org> wrote:
> > >  
> > >> Hello,
> > >>
> > >> This patchset add 'function-fork' option to function tracer which
> > >> makes pid filter to be inherited like 'event-fork' does.  During the
> > >> test, I found a bug of pid filter on an instance directory.  The patch
> > >> 1 fixes it and maybe it should go to the stable tree.
> > >>
> > >> The function-fork option is disabled by default as event-fork does,
> > >> but we might consider changing the default since it seems to be more
> > >> natural from an user's perspective IMHO.  
> > >
> > > By the way, I thought that event-fork option also effected to
> > > function tracer. Is there any reason we should separate those?
> > > I mean, we can add "trace-fork" option instead of "function-fork"
> > > for setting both pid filters at once.
> > >
> > > Thank you,  
> > 
> > I'm ok with combining two options.
> >
> 
> I prefer not. Mainly because they are two different mechanisms, and
> only event-fork is available now.

That sounds like implementation issue. From the viewpoint of users,
they may want to use just one knob to filter both. And I didn't
suggest replacing event-fork, but adding trace-fork for both, like a
superset option.

> trace-cmd will use ptrace if function
> fork is needed. Having it separate will let trace-cmd know if it needs
> to use ptrace or not for function forking.

Yeah, that's a good workaround for older kernel.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>