linux-kernel - Re: strace of io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <D9FAB37B-D059-4137-A115-616237D78640@amacapital.net>
Date:   Wed, 15 Jul 2020 07:35:50 -0700
From:   Andy Lutomirski <luto@...capital.net>
To:     Miklos Szeredi <miklos@...redi.hu>,
        Kees Cook <keescook@...omium.org>,
        Christian Brauner <christian.brauner@...ntu.com>
Cc:     strace-devel@...ts.strace.io, io-uring@...r.kernel.org,
        Pavel Begunkov <asml.silence@...il.com>,
        Linux API <linux-api@...r.kernel.org>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: strace of io_uring events?



> On Jul 15, 2020, at 4:12 AM, Miklos Szeredi <miklos@...redi.hu> wrote:
> 
> Hi,
> 
> This thread is to discuss the possibility of stracing requests
> submitted through io_uring.   I'm not directly involved in io_uring
> development, so I'm posting this out of  interest in using strace on
> processes utilizing io_uring.
> 
> io_uring gives the developer a way to bypass the syscall interface,
> which results in loss of information when tracing.  This is a strace
> fragment on  "io_uring-cp" from liburing:
> 
> io_uring_enter(5, 40, 0, 0, NULL, 8)    = 40
> io_uring_enter(5, 1, 0, 0, NULL, 8)     = 1
> io_uring_enter(5, 1, 0, 0, NULL, 8)     = 1
> ...
> 
> What really happens are read + write requests.  Without that
> information the strace output is mostly useless.
> 
> This loss of information is not new, e.g. calls through the vdso or
> futext fast paths are also invisible to strace.  But losing filesystem
> I/O calls are a major blow, imo.
> 
> What do people think?
> 
> From what I can tell, listing the submitted requests on
> io_uring_enter() would not be hard.  Request completion is
> asynchronous, however, and may not require  io_uring_enter() syscall.
> Am I correct?
> 
> Is there some existing tracing infrastructure that strace could use to
> get async completion events?  Should we be introducing one?
> 
> 

Let’s add some seccomp folks. We probably also want to be able to run seccomp-like filters on io_uring requests. So maybe io_uring should call into seccomp-and-tracing code for each action.