linux-kernel - Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170330094929.15135530@gandalf.local.home>
Date:   Thu, 30 Mar 2017 09:49:29 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Namhyung Kim <namhyung@...nel.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>, kernel-team@....com
Subject: Re: [PATCH 0/4] ftrace: Add 'function-fork' trace option (v1)

On Thu, 30 Mar 2017 10:40:46 +0900
Namhyung Kim <namhyung@...nel.org> wrote:

> Hi Masami,
> 
> On Thu, Mar 30, 2017 at 9:54 AM, Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > On Wed, 29 Mar 2017 10:46:21 +0900
> > Namhyung Kim <namhyung@...nel.org> wrote:
> >  
> >> Hello,
> >>
> >> This patchset add 'function-fork' option to function tracer which
> >> makes pid filter to be inherited like 'event-fork' does.  During the
> >> test, I found a bug of pid filter on an instance directory.  The patch
> >> 1 fixes it and maybe it should go to the stable tree.
> >>
> >> The function-fork option is disabled by default as event-fork does,
> >> but we might consider changing the default since it seems to be more
> >> natural from an user's perspective IMHO.  
> >
> > By the way, I thought that event-fork option also effected to
> > function tracer. Is there any reason we should separate those?
> > I mean, we can add "trace-fork" option instead of "function-fork"
> > for setting both pid filters at once.
> >
> > Thank you,  
> 
> I'm ok with combining two options.
>

I prefer not. Mainly because they are two different mechanisms, and
only event-fork is available now. trace-cmd will use ptrace if function
fork is needed. Having it separate will let trace-cmd know if it needs
to use ptrace or not for function forking.

-- Steve