| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAP-5=fUXJ6fW4738Fnx9AK2mPeA74ZpYKv=Ui6wYLWXE3KRRTQ@mail.gmail.com> Date: Mon, 2 Jun 2025 23:26:12 -0700 From: Ian Rogers <irogers@...gle.com> To: Namhyung Kim <namhyung@...nel.org> Cc: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>, Mark Rutland <mark.rutland@....com>, Alexander Shishkin <alexander.shishkin@...ux.intel.com>, Jiri Olsa <jolsa@...nel.org>, Adrian Hunter <adrian.hunter@...el.com>, Kan Liang <kan.liang@...ux.intel.com>, James Clark <james.clark@...aro.org>, Dapeng Mi <dapeng1.mi@...ux.intel.com>, Thomas Richter <tmricht@...ux.ibm.com>, Veronika Molnarova <vmolnaro@...hat.com>, Hao Ge <gehao@...inos.cn>, Howard Chu <howardchu95@...il.com>, Weilin Wang <weilin.wang@...el.com>, Levi Yun <yeoreum.yun@....com>, "Dr. David Alan Gilbert" <linux@...blig.org>, Dominique Martinet <asmadeus@...ewreck.org>, Xu Yang <xu.yang_2@....com>, Tengda Wu <wutengda@...weicloud.com>, linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org, bpf@...r.kernel.org Subject: Re: [PATCH v3 00/10] Move uid filtering to BPF filters On Mon, Jun 2, 2025 at 9:41 PM Namhyung Kim <namhyung@...nel.org> wrote: > > Hi Ian, > > On Tue, May 27, 2025 at 01:39:21PM -0700, Ian Rogers wrote: > > On Fri, Apr 25, 2025 at 2:40 PM Ian Rogers <irogers@...gle.com> wrote: > > > > > > Rather than scanning /proc and skipping PIDs based on their UIDs, use > > > BPF filters for uid filtering. The /proc scanning in thread_map is > > > racy as the PID may exit before the perf_event_open causing perf to > > > abort. BPF UID filters are more robust as they avoid the race. The > > > /proc scanning also misses processes starting after the perf > > > command. Add a helper for commands that support UID filtering and wire > > > up. Remove the non-BPF UID filtering support given it doesn't work. > > > > > > v3: Add lengthier commit messages as requested by Arnaldo. Rebase on > > > tmp.perf-tools-next. > > > > > > v2: Add a perf record uid test (Namhyung) and force setting > > > system-wide for perf trace and perf record (Namhyung). Ensure the > > > uid filter isn't set on tracepoint evsels. > > > > > > v1: https://lore.kernel.org/lkml/20250111190143.1029906-1-irogers@google.com/ > > > > Ping. Thanks, > > I'm ok with preferring BPF over /proc scanning, but still hesitate to > remove it since some people don't use BPF. Can you please drop that > part and make parse_uid_filter() conditional on BPF? Hi Namhyung, The approach of scanning /proc fails as: 1) processes that start after perf starts will be missed, 2) processes that terminate between being scanned in /proc and perf_event_open will cause perf to fail (essentially the -u option is just sugar to scan /proc and then provide the processes as if they were a -p option - such an approach doesn't need building into the tool). This patch series adds a test [1] and perf test has lots of processes starting and exiting, matching condition (2) above*. If this series were changed to an approach that uses BPF and falls back on /proc scanning then the -u option would be broken for both reasons above but also prove a constant source of test flakes. Rather than give the users something both frustrating to use (keeps quitting due to failed opens) and broken (missing processes) I think it is better to quit perf at that point informing the user they need more permissions to load the BPF program. This also makes the -u option testable. So the request for a change I don't think is sensible as it provides a worse user and testing experience. There is also the cognitive load of having the /proc scanning code in the code base, whereas the BPF filter is largely isolated. Thanks, Ian [1] https://lore.kernel.org/lkml/20250425214008.176100-6-irogers@google.com/ * rescord.sh is marked as exclusive currently, but this shouldn't really be necessary. > Thanks, > Namhyung > > > > > Ian Rogers (10): > > > perf parse-events filter: Use evsel__find_pmu > > > perf target: Separate parse_uid into its own function > > > perf parse-events: Add parse_uid_filter helper > > > perf record: Switch user option to use BPF filter > > > perf tests record: Add basic uid filtering test > > > perf top: Switch user option to use BPF filter > > > perf trace: Switch user option to use BPF filter > > > perf bench evlist-open-close: Switch user option to use BPF filter > > > perf target: Remove uid from target > > > perf thread_map: Remove uid options > > > > > > tools/perf/bench/evlist-open-close.c | 36 ++++++++------ > > > tools/perf/builtin-ftrace.c | 1 - > > > tools/perf/builtin-kvm.c | 2 - > > > tools/perf/builtin-record.c | 27 ++++++----- > > > tools/perf/builtin-stat.c | 4 +- > > > tools/perf/builtin-top.c | 22 +++++---- > > > tools/perf/builtin-trace.c | 27 +++++++---- > > > tools/perf/tests/backward-ring-buffer.c | 1 - > > > tools/perf/tests/event-times.c | 8 ++- > > > tools/perf/tests/keep-tracking.c | 2 +- > > > tools/perf/tests/mmap-basic.c | 2 +- > > > tools/perf/tests/openat-syscall-all-cpus.c | 2 +- > > > tools/perf/tests/openat-syscall-tp-fields.c | 1 - > > > tools/perf/tests/openat-syscall.c | 2 +- > > > tools/perf/tests/perf-record.c | 1 - > > > tools/perf/tests/perf-time-to-tsc.c | 2 +- > > > tools/perf/tests/shell/record.sh | 26 ++++++++++ > > > tools/perf/tests/switch-tracking.c | 2 +- > > > tools/perf/tests/task-exit.c | 1 - > > > tools/perf/tests/thread-map.c | 2 +- > > > tools/perf/util/bpf-filter.c | 2 +- > > > tools/perf/util/evlist.c | 3 +- > > > tools/perf/util/parse-events.c | 33 ++++++++----- > > > tools/perf/util/parse-events.h | 1 + > > > tools/perf/util/python.c | 10 ++-- > > > tools/perf/util/target.c | 54 +++------------------ > > > tools/perf/util/target.h | 15 ++---- > > > tools/perf/util/thread_map.c | 32 ++---------- > > > tools/perf/util/thread_map.h | 6 +-- > > > tools/perf/util/top.c | 4 +- > > > tools/perf/util/top.h | 1 + > > > 31 files changed, 150 insertions(+), 182 deletions(-) > > > > > > -- > > > 2.49.0.850.g28803427d3-goog > > >
Powered by blists - more mailing lists