linux-kernel - Re: [PATCH] tracing: Allow creating instances with specified system events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 29 Nov 2023 10:25:45 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        dmaluka@...gle.com, Sean Paul <seanpaul@...omium.org>,
        Arun Easi <aeasi@...vell.com>, Daniel Wagner <dwagner@...e.de>
Subject: Re: [PATCH] tracing: Allow creating instances with specified system
 events

On Wed, 29 Nov 2023 23:58:21 +0900
Masami Hiramatsu (Google) <mhiramat@...nel.org> wrote:

> > - Dynamic events had to be specified directly to still allow them to be
> >   created.  
> 
> I have a question about this point. Does this mean the dynamic event files
> will be created in the instance which limits the "system"?
> For this point, I would like to allow limiting dynamic events on instance too.
> If user needs to use specific one, e.g. synthetic, then it is possible to
> add it to the filter.

I'm going back and forth on this. Here's my thoughts about it.

Arguments for allowing all dynamic events:

1. There's not many. This code is basically a way to keep the overhead of
   an instance down. By removing all static events, it can substantially lower
   the memory footprint.

   As synthetic events are user created, there shouldn't be too many that
   would cause a memory foot print issue, and the user also has a bit of
   control of what events are created.

2. We have no idea what a user may want to do with those events. What if
   the user wants to see an event in that buffer and creates a synthetic
   event for it? Should the kernel create a policy for that?

Arguments against defaulting dynamic events in:

1. The list is created in the kernel. The instance is not created by the
   user and thus the kernel could have more control over it.

2. If the user really wants to have dynamic events, they can create another
   instance with the needed events or use the top level.

Hmm, writing this out, I am now leaning more toward not defaulting dynamic
events in. And if we can create a way to dynamically add and remove events
systems from an instance (via mkdir and rmdir), this should not be an issue.

Anyone else have any thoughts about this?

-- Steve