linux-kernel - Re: [PATCH 1/2] input: Add tracepoint support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2b31b238-667e-47b9-b61f-76832a1f77a7@efficios.com>
Date: Tue, 22 Jul 2025 21:24:27 -0400
From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To: Steven Rostedt <rostedt@...dmis.org>, WangYuli <wangyuli@...ontech.com>
Cc: dmitry.torokhov@...il.com, guanwentao@...ontech.com,
 linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org, mhiramat@...nel.org,
 niecheng1@...ontech.com, wangyuli@...pin.org, zhanjun@...ontech.com,
 Winston Wen <wentao@...ontech.com>
Subject: Re: [PATCH 1/2] input: Add tracepoint support

On 2025-07-22 20:25, Steven Rostedt wrote:
> On Thu, 10 Jul 2025 15:31:38 +0800
> WangYuli <wangyuli@...ontech.com> wrote:
> 
>> diff --git a/include/trace/events/input.h b/include/trace/events/input.h
>> new file mode 100644
>> index 000000000000..3c5ffcfb7c8d
>> --- /dev/null
>> +++ b/include/trace/events/input.h
>> @@ -0,0 +1,251 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +/* input tracepoints
>> + *
>> + * Copyright (C) 2025 WangYuli <wangyuli@...ontech.com>
>> + */
>> +#undef TRACE_SYSTEM
>> +#define TRACE_SYSTEM input
>> +
>> +#if !defined(_TRACE_INPUT_H) || defined(TRACE_HEADER_MULTI_READ)
>> +#define _TRACE_INPUT_H
>> +
>> +#include <linux/tracepoint.h>
>> +#include <linux/input.h>
>> +
>> +/**
>> + * input_event - called when an input event is processed
>> + * @dev: input device that generated the event
>> + * @type: event type (EV_KEY, EV_REL, EV_ABS, etc.)
>> + * @code: event code within the type
>> + * @value: event value
>> + *
>> + * This tracepoint fires for every input event processed by the input core.
>> + * It can be used to monitor input device activity and debug input issues.
>> + */

I've always been worried about adding tracepoint instrumentation of the
input subsystem that includes the actual keystrokes into the event
payload. What I'm trying to avoid here is people leaking their password
by mistake just because they happened to record a trace while
typing on their keyboard.

I don't mind if this gets enabled with a new kernel command line
options "tracing_leak_my_credentials=yes" or such, but I'd try to
avoid making it easy to enable by mistake unless this information
is specifically needed.

But maybe I'm being too careful and people should really learn not
to share kernel traces with others.

Thoughts ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com