linux-kernel - Re: [PATCH 1/2] tracing: Add a trace for task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 May 2021 16:55:22 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     ebiederm@...ssion.com (Eric W. Biederman)
Cc:     <Peter.Enderborg@...y.com>, <mathieu.desnoyers@...icios.com>,
        <linux-kernel@...r.kernel.org>, <mingo@...hat.com>,
        <akpm@...ux-foundation.org>, <peterz@...radead.org>,
        <ast@...nel.org>, <christian.brauner@...ntu.com>,
        <dave@...olabs.net>, <walken@...gle.com>, <jannh@...gle.com>,
        <christophe.leroy@....fr>, <minchan@...nel.org>
Subject: Re: [PATCH 1/2] tracing: Add a trace for task_exit

On Mon, 03 May 2021 14:02:48 -0500
ebiederm@...ssion.com (Eric W. Biederman) wrote:

> > However current traces is template based, and I assume it wont be
> > popular to add new fields to the template, and exit reasons is not
> > right for the other template use cases.

trace events can always add fields, it's removing them that can cause
problems (but even then, it's not that bad). The new libtracefs and
libtraceevent make it trivial for tools to get the fields from trace events
when needed.

> >
> > I still see a "new" task moving it to do_exit make trace name more
> > correct?  Or is trace_task_do_exit better?  

It is also trivial with the libraries to write a tool that can put together
everything you want. We even are working on python bindings to connect to
these libraries where you could write a python script to do this.

There is no need for a new tracepoint, especially if it makes it harder to
improve the implementation of what is being traced.

> 
> I really can't say, as I don't know much of anything about the tracing
> infrastructure.  I would assume in most cases with a tracepoint in place
> other kinds of tracing (like bpf programs) could come into play and read
> out pieces of information that are not commonly wanted.
> 
> All I really know something about is the exit code path, as I keep
> slowly trying to clean it up.  I plan on ignoring any tracepoint that
> makes that gets in the way.

As you should.

-- Steve