linux-kernel - [tip:perf/core] perf trace: Filter out 'sshd' in the tracer ancestry in syswide tracing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <tip-68rjeao9wnpylla41htk7xps@git.kernel.org>
Date:   Wed, 26 Jul 2017 10:18:14 -0700
From:   tip-bot for Arnaldo Carvalho de Melo <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     dsahern@...il.com, mingo@...nel.org, namhyung@...nel.org,
        hpa@...or.com, tglx@...utronix.de, wangnan0@...wei.com,
        acme@...hat.com, jolsa@...nel.org, linux-kernel@...r.kernel.org,
        adrian.hunter@...el.com
Subject: [tip:perf/core] perf trace: Filter out 'sshd' in the tracer
 ancestry in syswide tracing

Commit-ID:  082ab9a18e532864d1ceecfb50221df62b1d5a92
Gitweb:     http://git.kernel.org/tip/082ab9a18e532864d1ceecfb50221df62b1d5a92
Author:     Arnaldo Carvalho de Melo <acme@...hat.com>
AuthorDate: Thu, 20 Jul 2017 11:32:05 -0300
Committer:  Arnaldo Carvalho de Melo <acme@...hat.com>
CommitDate: Thu, 20 Jul 2017 15:16:25 -0300

perf trace: Filter out 'sshd' in the tracer ancestry in syswide tracing

Avoiding a loop, so now its quite convenient to ssh to a machine and
then simply do:

	# perf trace

To trace all syscalls without causing a loop.

This was possible using --filter-pids, i.e. once you noticed the loop,
get the sshd pid and add it to --filter-pids, restarting the 'perf
trace'.

Now to figure out how to do that in a X terminal, the other common
scenario, which is way more involved, as there are multiple processes
communicating to process terminal activity...

Using --filter-pids + '-e \!syscall,names,you,dont,need' may be a good
approximation when having to do syswide tracing on your workstation.

Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: David Ahern <dsahern@...il.com>
Cc: Jiri Olsa <jolsa@...nel.org>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Wang Nan <wangnan0@...wei.com>
Link: http://lkml.kernel.org/n/tip-68rjeao9wnpylla41htk7xps@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
 tools/perf/builtin-trace.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 0ba36f0..05d24b6 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2241,10 +2241,24 @@ out_enomem:
 
 static int trace__set_filter_loop_pids(struct trace *trace)
 {
-	int nr = 1;
+	unsigned int nr = 1;
 	pid_t pids[32] = {
 		getpid(),
 	};
+	struct thread *thread = machine__find_thread(trace->host, pids[0], pids[0]);
+
+	while (thread && nr < ARRAY_SIZE(pids)) {
+		struct thread *parent = machine__find_thread(trace->host, thread->ppid, thread->ppid);
+
+		if (parent == NULL)
+			break;
+
+		if (!strcmp(thread__comm_str(parent), "sshd")) {
+			pids[nr++] = parent->tid;
+			break;
+		}
+		thread = parent;
+	}
 
 	return perf_evlist__set_filter_pids(trace->evlist, nr, pids);
 }