linux-kernel - Re: [RFC PATCH 00/11] bpf, trace, dtrace: DTrace BPF program type implementation and sample use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190521173618.2ebe8c1f@gandalf.local.home>
Date:   Tue, 21 May 2019 17:36:18 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Kris Van Hees <kris.van.hees@...cle.com>, netdev@...r.kernel.org,
        bpf@...r.kernel.org, dtrace-devel@....oracle.com,
        linux-kernel@...r.kernel.org, mhiramat@...nel.org, acme@...nel.org,
        ast@...nel.org, daniel@...earbox.net, peterz@...radead.org
Subject: Re: [RFC PATCH 00/11] bpf, trace, dtrace: DTrace BPF program type
 implementation and sample use

On Tue, 21 May 2019 13:55:34 -0700
Alexei Starovoitov <alexei.starovoitov@...il.com> wrote:

> > The reasons for these patches is because I cannot do the same with the existing
> > implementation.  Yes, I can do some of it or use some workarounds to accomplish
> > kind of the same thing, but at the expense of not being able to do what I need
> > to do but rather do some kind of best effort alternative.  That is not the goal
> > here.  
> 
> what you call 'workaround' other people call 'feature'.
> The kernel community doesn't accept extra code into the kernel
> when user space can do the same.

If that was really true, all file systems would be implemented on
FUSE ;-)

I was just at a technical conference that was not Linux focused, and I
talked to a lot of admins that said they would love to have Dtrace
scripts working on Linux unmodified.

I need to start getting more familiar with the workings of eBPF and
then look at what Dtrace has to see where something like this can be
achieved, but right now just NACKing patches outright isn't being
helpful. If you are not happy with this direction, I would love to see
conversations where Kris shows you exactly what is required (from a
feature perspective, not an implementation one) and we come up with a
solution.

-- Steve