From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0AC8AC67861 for ; Tue, 9 Apr 2024 15:46:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6DC4E6B0092; Tue, 9 Apr 2024 11:46:15 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 665BB6B0093; Tue, 9 Apr 2024 11:46:15 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5076E6B0095; Tue, 9 Apr 2024 11:46:15 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 32DEF6B0092 for ; Tue, 9 Apr 2024 11:46:15 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id EAED180489 for ; Tue, 9 Apr 2024 15:46:14 +0000 (UTC) X-FDA: 81990419868.19.8E2605A Received: from mail-pf1-f178.google.com (mail-pf1-f178.google.com [209.85.210.178]) by imf25.hostedemail.com (Postfix) with ESMTP id E8BE3A000A for ; Tue, 9 Apr 2024 15:46:12 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=oAKzqlhe; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf25.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.178 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712677573; a=rsa-sha256; cv=none; b=bO3AO8A3MojcFzEE+e1GFk4sjseWz+WSzo9+J3x+Rvopg7HGpsC5APW7F9iaYRQVI1nyle +j+85f9HUFCHUFTvXDLA/Unx6JYc2HJa3WgMoWtqEUptkwy73NZhiGoktIn4z7HbGUFCxO fiaecjTR1wwVsGdr3sZLfJjSu7Mlv2M= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=oAKzqlhe; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf25.hostedemail.com: domain of keescook@chromium.org designates 209.85.210.178 as permitted sender) smtp.mailfrom=keescook@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712677573; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TZb3iRMe5mVHNLzHciI0SO6cgHqSkIE7M20XVfQvi74=; b=aEyebO6tpe2x3MRJqX6NzisCQBKYtcJv6OTxGDP7zqqkM7nQvE0LsNYeo+cm1yz4U7xfcd X1/QURqfQ1ptSk1nsgYRItaZmfHAEUfphgJn/znwgnZkhCoKX6UUYrfJOOdzOenPdtWihj 4t2mvtnASBu97S3Rjwo94vo3PRMsbss= Received: by mail-pf1-f178.google.com with SMTP id d2e1a72fcca58-6ed11782727so2613552b3a.1 for ; Tue, 09 Apr 2024 08:46:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1712677572; x=1713282372; darn=kvack.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=TZb3iRMe5mVHNLzHciI0SO6cgHqSkIE7M20XVfQvi74=; b=oAKzqlheZxGnupPKqos3O5Gb8Ne3Y2MqX0DwvuuZdcRjla7xJ9N45fJHuJZD8I+NkS ibOqixMP0E1LoMFfFUKYnFMftMa5OyYBqm8emYln8vscFQTqp/mG7LXWdJCY2SZmCO3i LAmipN4kYsQEBJ9jp0a52bfAy7/G/7nJ/Zb8I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712677572; x=1713282372; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=TZb3iRMe5mVHNLzHciI0SO6cgHqSkIE7M20XVfQvi74=; b=EjKq9dewNbDFOJU60BXtZ6FDG0X9P8laT0TbOnK8thzisyAPgoCGQ1oz7T1Zl4mbw1 KekznytGLuEUSjg9iCiVQOW7AvxLWfbTjbHPGfyiaRLG9ikBol5R1uV5JkU1wCynGZEB 9SR0JOTKYe1z3qZg79rYkl43NjqRH+Eid+BxER3lorVTz1mms34XlQ2gGbiLzoV6El9e f8jqL+uKq6hY1aLsrpLtxVF93Axxk7sg2l0OMyW/jNwNGebAZ2jAUYqN/CEXiHMs90Bt rvAkYEFu/HfNxchYDUDbr/GtjuIydnYFC5UFvg66CNyVgiKEI1SZTUr913+udwanl5pb w8bQ== X-Forwarded-Encrypted: i=1; AJvYcCWJYbAEaPR5qQG/UNvPlkhHSGh7DGt5OAeEMwhndjd9zqJq7c5o3st0TG3/JpLLLegyOrkm9yXM9gLNVJbsTYRZtmI= X-Gm-Message-State: AOJu0Yz4JK7osgSG7bdlTht8EF9EcseWVad4VnY45d1PfmTzS9MbQDpX OHDSx132LwJnL89gmHeCGsACYwm9Nike192A2fu9KKoNaChqxYWnAyBrnhBecQ== X-Google-Smtp-Source: AGHT+IFY4YnmxxIgxT9REWRm8+8QvKZDpcEh61QeY1CTDZRblqm40N34Vq/Eeh+kF58mWnqkXyrA8A== X-Received: by 2002:a05:6a00:2355:b0:6ec:da6c:fc2d with SMTP id j21-20020a056a00235500b006ecda6cfc2dmr13723474pfj.23.1712677571643; Tue, 09 Apr 2024 08:46:11 -0700 (PDT) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id 27-20020a630f5b000000b005dc5289c4edsm8296124pgp.64.2024.04.09.08.46.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Apr 2024 08:46:11 -0700 (PDT) Date: Tue, 9 Apr 2024 08:46:10 -0700 From: Kees Cook To: Marco Elver Cc: Steven Rostedt , Eric Biederman , Alexander Viro , Christian Brauner , Jan Kara , Masami Hiramatsu , Mathieu Desnoyers , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov Subject: Re: [PATCH] tracing: Add new_exec tracepoint Message-ID: <202404090840.E09789B66@keescook> References: <20240408090205.3714934-1-elver@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240408090205.3714934-1-elver@google.com> X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: E8BE3A000A X-Stat-Signature: 8t74cha47dcnoed7e1eyg6mr65mhsdcg X-HE-Tag: 1712677572-344030 X-HE-Meta: U2FsdGVkX1+/xYu2mkXlUy7gvOmAxfZE4hmhErDK/koO1KeEcjuZhtpUlsDYlqdsGWKu0MWAWyRY0zE7rQR9gSIvCk6J22wjtfV86nwSTbWv5AFoFylYrfqXXONVuy1qPZIfXxObHRlcQUUit5qq8dh4O+aYDxPjOqKR66391L6bMrRg0ArZZpOw78cIR0Hy3R4qxkJZ48aBWaSELkNTle+y0wZQ8bsKc7x87wZ/a0ea/m/Ushpna2B/vTNbom70wjA1YLg6XmmjADJ4JcbcbzhpYqFaUfBVRuh5uLv0aMNLsijWap1SIblGyQH/BJbm7MIGlctqzxd+NJnsotiLbB7aIJzj4KpksTAsu+TTjo+h6JZFr9vDsh3bFBM3PWOMy1btrcW/YcpVXjOitQ7trOao30/iK2kSKzYSDRddX1PgaVgMuQjFTZbx8QitV9TlsWxxkZyfQDpMr//0yVXTGJ9n6baqQxT4wi+7SAVqK2bBx3obWu5Zt5NNaoSoTBA6RTm6A8OH+Wk+BY57Pb8HBk4Pt5T2s2VGpZhsDRbM85OFkwrjD7Bb/kMJ7O1sN3hXQO2c6sD1ycGgf0IbNjdolKYE4H14wQOZBfWG6BtFzDyOwCpkxa2QoD6YzMDkrv6j7WYWtb8+3eNnL4EFKbFqO7vi1f0IQ0X2TiqbMMg6oz2wUqc1mwfKx8/kaYy74Xsp0QejWb0V8ZOH3LftLPZWJ6nlO1ZjhtTaC40oXM74Xq/Q1IVJ2AyUxM6xCIUDIbTX+Mn78cz/vDRzrAwpTwdORN1eNREAi9mGIKgKfiuIfc3MCECboBrsSo4uN/lH6lonobQNpqJDXnOkgyIKCDdqwKjieRZ7dbDCIokW+wSc34iGyXA36RBjD9z/OL6CcwK82EZyRZrYeMV4mwP2AcqjT79GrGI0y6Zio/w+1hFxYWleE4gt/ij/8VvHqjD9QP7EKSJMum7k/ZUM7dAw9M9 vb2h4XUC /GwjW9BM4eLWt7Y2G60R9o2LLvLOVo2+yvQT/gvDFBVBdVJyhfg+Oe3XjtliTHrFelnyCgg8nndDBXhBKZ+N0fO1Kwiz9TLsQix1jeDZQwy79LU3zxXgKSOFBuRvUb5/IZTSlh0Kv25teHah4spedSuauG/z92Q+XiKr2hwvUVaSXQ7q6Y9z+iy2ZxLAUn4RV0AeHNzqy5K41HZJ7egZ0nnR4FbIvFqZcmqn6B8tTZCvEhBYbk9DP4GqOEnwEA/KVr04hfM2s5cOToHBjoRctYtkn+Jg+gwqzIieegbE5WXRMxSgqjt8X0npGIy62vrblO/9DjSEINONwJ8W/fBkppyhDdyxOzHvCt05uDjU27h3ilsMr0EnziJc7uZIhly8GrMekgPfoWGF8VESvNwO8eh4Wa0Qg3lnb6ysdpATHRN6b3ZA= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000001, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Apr 08, 2024 at 11:01:54AM +0200, Marco Elver wrote: > Add "new_exec" tracepoint, which is run right after the point of no > return but before the current task assumes its new exec identity. > > Unlike the tracepoint "sched_process_exec", the "new_exec" tracepoint > runs before flushing the old exec, i.e. while the task still has the > original state (such as original MM), but when the new exec either > succeeds or crashes (but never returns to the original exec). > > Being able to trace this event can be helpful in a number of use cases: > > * allowing tracing eBPF programs access to the original MM on exec, > before current->mm is replaced; > * counting exec in the original task (via perf event); > * profiling flush time ("new_exec" to "sched_process_exec"). > > Example of tracing output ("new_exec" and "sched_process_exec"): > > $ cat /sys/kernel/debug/tracing/trace_pipe > <...>-379 [003] ..... 179.626921: new_exec: filename=/usr/bin/sshd pid=379 comm=sshd > <...>-379 [003] ..... 179.629131: sched_process_exec: filename=/usr/bin/sshd pid=379 old_pid=379 > <...>-381 [002] ..... 180.048580: new_exec: filename=/bin/bash pid=381 comm=sshd > <...>-381 [002] ..... 180.053122: sched_process_exec: filename=/bin/bash pid=381 old_pid=381 > <...>-385 [001] ..... 180.068277: new_exec: filename=/usr/bin/tty pid=385 comm=bash > <...>-385 [001] ..... 180.069485: sched_process_exec: filename=/usr/bin/tty pid=385 old_pid=385 > <...>-389 [006] ..... 192.020147: new_exec: filename=/usr/bin/dmesg pid=389 comm=bash > bash-389 [006] ..... 192.021377: sched_process_exec: filename=/usr/bin/dmesg pid=389 old_pid=389 > > Signed-off-by: Marco Elver > --- > fs/exec.c | 2 ++ > include/trace/events/task.h | 30 ++++++++++++++++++++++++++++++ > 2 files changed, 32 insertions(+) > > diff --git a/fs/exec.c b/fs/exec.c > index 38bf71cbdf5e..ab778ae1fc06 100644 > --- a/fs/exec.c > +++ b/fs/exec.c > @@ -1268,6 +1268,8 @@ int begin_new_exec(struct linux_binprm * bprm) > if (retval) > return retval; > > + trace_new_exec(current, bprm); > + All other steps in this function have explicit comments about what/why/etc. Please add some kind of comment describing why the tracepoint is where it is, etc. For example, maybe something like: /* * Before any changes to 'current', report that the exec is about to * happen (since we made it to the point of no return). On a successful * exec, the 'sched_process_exec' tracepoint will also fire. On failure, * ... [something else] */ > +TRACE_EVENT(new_exec, > + > + TP_PROTO(struct task_struct *task, struct linux_binprm *bprm), > + > + TP_ARGS(task, bprm), > + > + TP_STRUCT__entry( > + __string( filename, bprm->filename ) > + __field( pid_t, pid ) > + __string( comm, task->comm ) > + ), > + > + TP_fast_assign( > + __assign_str(filename, bprm->filename); What about binfmt_misc, and binfmt_script? You may want bprm->interp too? -Kees > + __entry->pid = task->pid; > + __assign_str(comm, task->comm); > + ), > + > + TP_printk("filename=%s pid=%d comm=%s", > + __get_str(filename), __entry->pid, __get_str(comm)) > +); > + > #endif > > /* This part must be outside protection */ > -- > 2.44.0.478.gd926399ef9-goog > -- Kees Cook