From: Arnaldo Carvalho de Melo <acme@kernel•org>
To: Alexei Starovoitov <alexei.starovoitov@gmail•com>
Cc: Jiri Olsa <jolsa@redhat•com>,
Jesper Dangaard Brouer <brouer@redhat•com>,
Daniel Borkmann <daniel@iogearbox•net>,
ast@kernel•org, netdev@vger•kernel.org,
Jiri Olsa <jolsa@kernel•org>
Subject: Re: [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload
Date: Fri, 5 Oct 2018 16:42:49 -0300 [thread overview]
Message-ID: <20181005194249.GF20250@kernel.org> (raw)
In-Reply-To: <20181005184434.uphwrbqkfx2isbx4@ast-mbp.dhcp.thefacebook.com>
Em Fri, Oct 05, 2018 at 11:44:35AM -0700, Alexei Starovoitov escreveu:
> On Fri, Oct 05, 2018 at 08:14:09AM +0200, Jiri Olsa wrote:
> > On Thu, Oct 04, 2018 at 03:10:15PM -0700, Alexei Starovoitov wrote:
> > > On Thu, Oct 04, 2018 at 10:22:31PM +0200, Jesper Dangaard Brouer wrote:
> > > > My use-case is to 24/7 collect and keep records in userspace, and have a
> > > > timeline of these notifications, for later retrieval. The idea is that
> > > > our support engineers can look at these records when troubleshooting
> > > > the system. And the plan is also to collect these records as part of
> > > > our sosreport tool, which is part of the support case.
> > > I don't think you're implying that prog load/unload should be spamming dmesg
> > > and auditd not even running...
> > I think the problem Jesper implied is that in order to collect
> > those logs you'll need perf tool running all the time.. which
> > it's not equipped for yet
> I'm not proposing to run 'perf' binary all the time.
I think Jiri just said that one would have to run something all the time
to get all the records, see below
> Setting up perf ring buffer just for these new bpf prog load/unload events
> and epolling it is simple enough to do from any application including auditd.
> selftests/bpf/ do it for bpf output events.
I think he is talking about the preexisting loaded BPF programs. We have
the same problem with mmaps, where the perf tool will, with races,
enumerate the existing mmaps as PERF_RECORD_MMAP synthesized from
/proc/PIDS/smaps.
There was talk in the past to ask the kernel to emit PERF_RECORD_MMAP
into the ring buffer for those pre-existing entries, reducing a bit the
races, but as there doesn't seem to have a good way of doing it, we
continued with the synthesizing from procfs.
Is there a way for us to synthesize those prog load/unload for
preexisting loaded bpf objects?
- Arnaldo
next prev parent reply other threads:[~2018-10-06 2:43 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-04 13:50 [PATCH bpf-next] bpf: emit audit messages upon successful prog load and unload Daniel Borkmann
2018-10-04 17:11 ` Alexei Starovoitov
2018-10-04 18:39 ` Jesper Dangaard Brouer
2018-10-04 19:41 ` Daniel Borkmann
2018-10-04 20:22 ` Jesper Dangaard Brouer
2018-10-04 22:10 ` Alexei Starovoitov
2018-10-05 6:14 ` Jiri Olsa
2018-10-05 18:44 ` Alexei Starovoitov
2018-10-05 19:42 ` Arnaldo Carvalho de Melo [this message]
2018-10-05 20:26 ` Alexei Starovoitov
2018-10-05 22:05 ` Jiri Olsa
2018-10-07 16:19 ` Jesper Dangaard Brouer
2018-10-18 19:53 ` Richard Guy Briggs
2018-10-18 22:09 ` Steve Grubb
2018-10-08 11:57 ` Jiri Olsa
2018-10-10 19:53 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181005194249.GF20250@kernel.org \
--to=acme@kernel$(echo .)org \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=ast@kernel$(echo .)org \
--cc=brouer@redhat$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=jolsa@kernel$(echo .)org \
--cc=jolsa@redhat$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox