linux-kernel - Re: [PATCH] tracing: Allow creating instances with specified system events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Nov 2023 23:58:53 +0900
From:   Masami Hiramatsu (Google) <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux Trace Kernel <linux-trace-kernel@...r.kernel.org>,
        Mark Rutland <mark.rutland@....com>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        dmaluka@...gle.com, Sean Paul <seanpaul@...omium.org>,
        Arun Easi <aeasi@...vell.com>, Daniel Wagner <dwagner@...e.de>
Subject: Re: [PATCH] tracing: Allow creating instances with specified system
 events

On Wed, 29 Nov 2023 10:25:45 -0500
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Wed, 29 Nov 2023 23:58:21 +0900
> Masami Hiramatsu (Google) <mhiramat@...nel.org> wrote:
> 
> > > - Dynamic events had to be specified directly to still allow them to be
> > >   created.  
> > 
> > I have a question about this point. Does this mean the dynamic event files
> > will be created in the instance which limits the "system"?
> > For this point, I would like to allow limiting dynamic events on instance too.
> > If user needs to use specific one, e.g. synthetic, then it is possible to
> > add it to the filter.
> 
> I'm going back and forth on this. Here's my thoughts about it.
> 
> Arguments for allowing all dynamic events:
> 
> 1. There's not many. This code is basically a way to keep the overhead of
>    an instance down. By removing all static events, it can substantially lower
>    the memory footprint.
> 
>    As synthetic events are user created, there shouldn't be too many that
>    would cause a memory foot print issue, and the user also has a bit of
>    control of what events are created.

Sometimes synthetic event user != instance user. (Only the privileged user
will do, but maybe done by different program.)

> 2. We have no idea what a user may want to do with those events. What if
>    the user wants to see an event in that buffer and creates a synthetic
>    event for it? Should the kernel create a policy for that?

I think it is enough to give a choice to user. User can enable events
under synthetic, probes, etc. by mkdir later. IIUC, current implementation
forcibly exposes all dynamic events.

> 
> Arguments against defaulting dynamic events in:
> 
> 1. The list is created in the kernel. The instance is not created by the
>    user and thus the kernel could have more control over it.
> 
> 2. If the user really wants to have dynamic events, they can create another
>    instance with the needed events or use the top level.
> 
> Hmm, writing this out, I am now leaning more toward not defaulting dynamic
> events in. And if we can create a way to dynamically add and remove events
> systems from an instance (via mkdir and rmdir), this should not be an issue.

Yeah, that's my point. If we allow all dynamic events, it needs to change the
default behavior later. That will not be consistent.

Thank you,

> 
> Anyone else have any thoughts about this?
> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>