linux-kernel - Re: [PATCH] staging: tracing/kprobe: filter kprobe based perf event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Sep 2019 13:22:18 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jinshan Xiong <jinshan.xiong@...r.com>
Cc:     Yonghong Song <yhs@...com>,
        "jinshan.xiong@...il.com" <jinshan.xiong@...il.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "rostedt@...dmis.org" <rostedt@...dmis.org>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>
Subject: Re: [PATCH] staging: tracing/kprobe: filter kprobe based perf event

On Wed, Sep 18, 2019 at 8:13 AM Jinshan Xiong <jinshan.xiong@...r.com> wrote:
>
> The problem with the current approach is that it would be difficult to filter cgroup, especially the cgroup in question has descendents, and also it would spawn new descendents after BPF program is installed. it's hard to filter it inside a BPF program.

Why is that?
bpf_current_task_under_cgroup() fits exactly that purpose.