linux-kernel - Re: [PATCH] tracing: Add WARN_ON_ONCE for syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241128115226.504e7563@rorschach.local.home>
Date: Thu, 28 Nov 2024 11:52:26 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Cc: Tao Chen <chen.dylane@...il.com>, mhiramat@...nel.org,
 linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH] tracing: Add WARN_ON_ONCE for syscall_nr check

On Thu, 28 Nov 2024 11:02:31 -0500
Mathieu Desnoyers <mathieu.desnoyers@...icios.com> wrote:

> > A better solution is for there to be a return code or something where the
> > tracers (perf or ftrace) can record in the trace that the system call is
> > not supported.  
> 
> Just be careful not to spam the traces uselessly. E.g. if only the
> openat syscall is enabled, you'd only want to be made aware of the
> ia32 openat, not all ia32 syscalls.

Why not? If you ask to trace something that isn't able to be traced,
add something in the buffer. It's not totally useless information. If
anything, you know that a task is making ia32 system calls, and how
many and when they are doing so.

Why make it more complex than it has to be. To do it only once, you
need to add the accounting logic to make sure each trace gets notified
about it. Not to mention if the event gets dropped.

If the user doesn't want this in their buffer, then they should filter
it out.

-- Steve