From: Paul Moore <paul@paul-moore.com>
To: "Thiébaud Weksteen" <tweek@google.com>
Cc: Steven Rostedt <rostedt@goodmis.org>,
Stephen Smalley <stephen.smalley.work@gmail.com>,
Nick Kralevich <nnk@google.com>,
Joel Fernandes <joelaf@google.com>,
Eric Paris <eparis@parisplace.org>,
Ingo Molnar <mingo@redhat.com>,
Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Rob Herring <robh@kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
SElinux list <selinux@vger.kernel.org>
Subject: Re: [PATCH] selinux: add tracepoint on denials
Date: Tue, 28 Jul 2020 11:12:36 -0400 [thread overview]
Message-ID: <CAHC9VhT1sGSpfCKojbKR+O2Hf_h+wnKnBwwSo09CbFaCYLcOHA@mail.gmail.com> (raw)
In-Reply-To: <CA+zpnLfczC=9HQA8s1oBGKGQO+OkuydF85o89dhSxdOyKBHMgg@mail.gmail.com>
On Tue, Jul 28, 2020 at 8:49 AM Thiébaud Weksteen <tweek@google.com> wrote:
>
> Thanks for the review! I'll send a new revision of the patch with the
> %x formatter and using the TP_CONDITION macro.
>
> On adding further information to the trace event, I would prefer
> adding the strict minimum to be able to correlate the event with the
> avc message. The reason is that tracevents have a fixed size (see
> https://www.kernel.org/doc/Documentation/trace/events.txt). For
> instance, we would need to decide on a maximum size for the string
> representation of the list of permissions.
It sounds like this is no longer an issue, hopefully this changes your
thinking as I'm not sure how usable it would be in practice for users
not overly familiar with SELinux.
Perhaps it would be helpful if you provided an example of how one
would be expected to use this new tracepoint? That would help put
things in the proper perspective.
> This would also duplicate
> the reporting done in the avc audit event. I'll simply add the pid as
> part of the printk, which should be sufficient for the correlation.
Well, to be honest, the very nature of this tracepoint is duplicating
the AVC audit record with a focus on using perf to establish a full
backtrace at the expense of reduced information. At least that is how
it appears to me.
--
paul moore
www.paul-moore.com
next prev parent reply other threads:[~2020-07-28 15:12 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-24 9:15 [PATCH] selinux: add tracepoint on denials Thiébaud Weksteen
2020-07-24 13:32 ` Stephen Smalley
2020-07-24 13:54 ` Paul Moore
2020-07-28 12:49 ` Thiébaud Weksteen
2020-07-28 13:04 ` Stephen Smalley
2020-07-28 13:19 ` Thiébaud Weksteen
2020-07-28 13:12 ` Steven Rostedt
2020-07-28 13:23 ` Thiébaud Weksteen
2020-07-28 15:12 ` Paul Moore [this message]
2020-07-28 16:02 ` Thiébaud Weksteen
2020-07-28 16:19 ` Stephen Smalley
2020-07-28 16:20 ` Paul Moore
2020-07-30 15:50 ` Thiébaud Weksteen
2020-07-30 8:03 ` peter enderborg
2020-07-24 13:52 ` Steven Rostedt
2020-07-30 14:29 ` [PATCH] RFC: selinux avc trace peter enderborg
2020-07-30 14:50 ` Stephen Smalley
2020-07-30 15:47 ` peter enderborg
2020-07-30 15:04 ` Steven Rostedt
2020-07-30 15:31 ` peter enderborg
2020-07-30 16:02 ` Steven Rostedt
2020-07-30 17:05 ` peter enderborg
2020-07-30 17:16 ` Steven Rostedt
2020-07-30 19:12 ` peter enderborg
2020-07-30 19:29 ` Steven Rostedt
2020-07-30 19:50 ` peter enderborg
2020-07-31 11:07 ` Thiébaud Weksteen
2020-07-28 15:22 ` [PATCH] selinux: add tracepoint on denials Joel Fernandes
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhT1sGSpfCKojbKR+O2Hf_h+wnKnBwwSo09CbFaCYLcOHA@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=davem@davemloft.net \
--cc=eparis@parisplace.org \
--cc=joelaf@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab+huawei@kernel.org \
--cc=mingo@redhat.com \
--cc=nnk@google.com \
--cc=robh@kernel.org \
--cc=rostedt@goodmis.org \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tweek@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).