linux-kernel - Re: [PATCH 0/2] Enable new kprobe event at boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190522003932.34367dcae6d9de27e254e174@kernel.org>
Date:   Wed, 22 May 2019 00:39:32 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Ingo Molnar <mingo@...nel.org>,
        "Naveen N . Rao" <naveen.n.rao@...ux.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S . Miller" <davem@...emloft.net>,
        linux-kernel@...r.kernel.org, linux-doc@...r.kernel.org
Subject: Re: [PATCH 0/2] Enable new kprobe event at boot

On Tue, 21 May 2019 09:33:17 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Tue, 21 May 2019 16:56:16 +0900
> Masami Hiramatsu <mhiramat@...nel.org> wrote:
> 
> > Note that 'trace_event=' option enables trace event at very early
> > timing, but the events added by 'kprobe_event=' are enabled right
> > before enabling device drivers at this point. It is enough for
> > tracing device driver initialization etc.
> 
> Nice!
> 
> I wonder if we can have this called before the trace_event boot is
> analyzed. Then have the kprobe_event work more like the kprobe_events
> file, and not enable the kprobes but only create them. If you want to
> enable them you do a trace_event=kprobes as well.

Yeah, I considered that, but there are several reasons to not to do that.
- trace_event seems enabled very early point than kprobes itself.(but this can
  be fixable)
- if user specifies kprobes at boot, he/she wants to enable that point at boot.
- it is redundant to specify kprobe_event= and trace_event=, especially command
  line size is very limited.

> Perhaps we could enable kprobes at early init?

It should be possible, I will try to find what blocks it. I guess after we
switch early_text_poke() to text_poke(), we can use kprobes on x86. But
for other archs, I need to investigate more.

> What do you think? Or is there something else in kprobes that prevents
> such an early enabling of it?

As I pointed above, I think we should enable it if user specify it. That's
less typing :). Anyway I'll recheck early kprobe availablity.

Thank you,


-- 
Masami Hiramatsu <mhiramat@...nel.org>