From: Steven Rostedt <rostedt@goodmis.org>
To: Tzvetomir Stoyanov <tz.stoyanov@gmail.com>
Cc: Linux Trace Devel <linux-trace-devel@vger.kernel.org>
Subject: Re: [PATCH v2 4/9] trace-cmd agent: Allow for ip connections from the agent
Date: Mon, 18 Apr 2022 15:37:23 -0400 [thread overview]
Message-ID: <20220418153723.1d723638@gandalf.local.home> (raw)
In-Reply-To: <CAPpZLN6UyZ00koS+FWWsq_SKYpoYMkSb_TTNmehG2LwBu3P6OA@mail.gmail.com>
On Mon, 18 Apr 2022 13:22:51 +0300
Tzvetomir Stoyanov <tz.stoyanov@gmail.com> wrote:
> On Mon, Apr 18, 2022 at 11:28 AM Steven Rostedt <rostedt@goodmis.org> wrote:
> >
> > From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
> >
> > Add a -N option to trace-cmd agent to listen on a network socket that
> > can be used by trace-cmd record -A to connect with.
> >
>
> I have concerns about exposing the agent over the network, without any
> client authentication. It runs with root privileges, the kernel
> tracing data will be exposed to anyone over the network. At least,
> this should be written clearly in the documentation and even should be
> printed by "trace-cmd agent -N ...". I saw your patch that adds a name
> or IP address of the client as parameter, it is some security, but the
> tracing data itself still flows unencrypted over the network and could
> be visible to anyone.
True. But it's similar to telnet. The use case for this option is for local
networks where you expect to "trust" the network.
I'm fine with adding more warnings and stating that this is "NOT SECURE" in
big letters to let people know the dangers of it. I'm hoping to have more
authentication in the future.
I could even have it print a warning "UNSECURE CONNECTION" or something to
enforce that this is not something you want to use in any scenario.
-- Steve
next prev parent reply other threads:[~2022-04-18 19:37 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-17 18:45 [PATCH v2 0/9] trace-cmd: Allow agent to use networking Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 1/9] trace-cmd record: Move port_type into instance Steven Rostedt
2022-04-18 10:22 ` Tzvetomir Stoyanov
2022-04-18 19:33 ` Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 2/9] trace-cmd library: Add network roles for time sync Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 3/9] trace-cmd record: Allow for ip connections to agents Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 4/9] trace-cmd agent: Allow for ip connections from the agent Steven Rostedt
2022-04-18 10:22 ` Tzvetomir Stoyanov
2022-04-18 19:37 ` Steven Rostedt [this message]
2022-04-17 18:45 ` [PATCH v2 5/9] trace-cmd library: Create tracecmd_debug() for debug printing Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 6/9] trace-cmd: Add debug prints for network connections Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 7/9] trace-cmd: Add print helpers to show connections Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 8/9] trace-cmd: Override tracecmd_debug() to show thread id Steven Rostedt
2022-04-17 18:45 ` [PATCH v2 9/9] trace-cmd agent: Have agent work without vsockets available Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220418153723.1d723638@gandalf.local.home \
--to=rostedt@goodmis.org \
--cc=linux-trace-devel@vger.kernel.org \
--cc=tz.stoyanov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.