linux-kernel - Re: [PATCH 3/3 v11] printk: Add monotonic, boottime, and realtime timestamps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Sep 2017 07:29:43 -0700
From:   Mark Salyzyn <salyzyn@...roid.com>
To:     Petr Mladek <pmladek@...e.com>, Prarit Bhargava <prarit@...hat.com>
Cc:     linux-kernel@...r.kernel.org, Jonathan Corbet <corbet@....net>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        John Stultz <john.stultz@...aro.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Stephen Boyd <sboyd@...eaurora.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
        Christoffer Dall <cdall@...aro.org>,
        Deepa Dinamani <deepa.kernel@...il.com>,
        Ingo Molnar <mingo@...nel.org>,
        Joel Fernandes <joelaf@...gle.com>,
        Kees Cook <keescook@...omium.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Geert Uytterhoeven <geert+renesas@...der.be>,
        "Luis R. Rodriguez" <mcgrof@...nel.org>,
        Nicholas Piggin <npiggin@...il.com>,
        "Jason A. Donenfeld" <Jason@...c4.com>,
        Olof Johansson <olof@...om.net>,
        Josh Poimboeuf <jpoimboe@...hat.com>, linux-doc@...r.kernel.org
Subject: Re: [PATCH 3/3 v11] printk: Add monotonic, boottime, and realtime
 timestamps

On 09/15/2017 06:28 AM, Petr Mladek wrote:
> I am still slightly nervous that external tools would need updating.
> Also they might have troubles to interpret the time stamps especially
> when the source is changed at runtime via
> /sys/module/printk/parameters/time.
My comment below is a rehash/summary:

In the discussion, it appears that DAC protection is enough to prevent 
flippant changes. The use cases I can imagine for runtime alteration 
fall in two groups, late boot changes after all disks are mounted and 
the application layers have started; or as an aid to debugging where the 
deliberate nature can be accounted for. Change it, erase the logs is the 
KISS solution, so the tools do not have to 'sniff' the stream for 
dynamic changes, likely getting the 'leader' wrong, checking 
/sys/module/printk/parameters/time for the current/last timebase.

To mitigate the 'leader' issue, or post-mortem/off-machine 
interpretation, really for the debugging corner case IMHO, I had 
proposed that local, and perhaps monotonic, time print as-is as they are 
almost(?) imperceptibly different, but that realtime add a U suffix (to 
denote time is UTC), and that boottime add a B suffix (well, because) so 
that tools can discern. Monotonic could have a M suffix if it is really 
a stickler. This proposal would require more disruptive tool 
modifications and should be scoped as a separate effort. I do expect a 
debate regarding upper and lower case ...

I have a patch waiting in the wings here where disruptive time changes 
(suspend/resume/hibernate/restore; maybe date(1), ntpd(8) or embedded 
systems LTE hardware time updates) will report dual timestamps so that 
resynchronization and tracking can happen in post-mortem on the stream, 
I expect to use the above proposal for the 'second' occasional timestamp.

-- Mark