Re: [RFC PATCH v2 0/3] perf/tracefs: Container-aware tracing support

Re: [RFC PATCH v2 0/3] perf/tracefs: Container-aware tracing support

[Eric W. Biederman]

Hari Bathini <hbathini-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:

> This RFC patch set supports filtering container specific events
> when perf tool is executed inside a container. The patches apply
> cleanly on v4.7.0-rc7
>
> Changes from v1:
> 1/3. Revived earlier approach[1] with cgroup namespace instead
>      of pid namespace
> 2/3. New patch that adds instance support for uprobe events in
>      tracefs filesystem
> 3/3. New patch that adds "newinstance" mount option for tracefs
>      filesystem
       "newinstace" ick no.

I see no justification anywhere why the perf cgroup is not enough for
this.

Eric

Re: [RFC PATCH v2 0/3] perf/tracefs: Container-aware tracing support

[Aravinda Prasad]

On Thursday 04 August 2016 08:29 AM, Eric W. Biederman wrote:
> Hari Bathini <hbathini-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:
> 
>> This RFC patch set supports filtering container specific events
>> when perf tool is executed inside a container. The patches apply
>> cleanly on v4.7.0-rc7
>>
>> Changes from v1:
>> 1/3. Revived earlier approach[1] with cgroup namespace instead
>>      of pid namespace
>> 2/3. New patch that adds instance support for uprobe events in
>>      tracefs filesystem
>> 3/3. New patch that adds "newinstance" mount option for tracefs
>>      filesystem
>        "newinstace" ick no.
> 
> I see no justification anywhere why the perf cgroup is not enough for
> this.

perf cgroup is not enough for uprobes, because even with perf cgroups a
user within a container can still list/delete uprobes registered in
other containers.

Regards,
Aravinda

> 
> Eric
> 

-- 
Regards,
Aravinda

Re: [RFC PATCH v2 0/3] perf/tracefs: Container-aware tracing support

[Eric W. Biederman]

Aravinda Prasad <aravinda-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:

> On Thursday 04 August 2016 08:29 AM, Eric W. Biederman wrote:
>> Hari Bathini <hbathini-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:
>> 
>>> This RFC patch set supports filtering container specific events
>>> when perf tool is executed inside a container. The patches apply
>>> cleanly on v4.7.0-rc7
>>>
>>> Changes from v1:
>>> 1/3. Revived earlier approach[1] with cgroup namespace instead
>>>      of pid namespace
>>> 2/3. New patch that adds instance support for uprobe events in
>>>      tracefs filesystem
>>> 3/3. New patch that adds "newinstance" mount option for tracefs
>>>      filesystem
>>        "newinstace" ick no.
>> 
>> I see no justification anywhere why the perf cgroup is not enough for
>> this.
>
> perf cgroup is not enough for uprobes, because even with perf cgroups a
> user within a container can still list/delete uprobes registered in
> other containers.

Just to be clear, even if there is one cgroup per container?

Eric

Re: [RFC PATCH v2 0/3] perf/tracefs: Container-aware tracing support

[Aravinda Prasad]

On Thursday 04 August 2016 11:57 PM, Eric W. Biederman wrote:
> Aravinda Prasad <aravinda-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:
> 
>> On Thursday 04 August 2016 08:29 AM, Eric W. Biederman wrote:
>>> Hari Bathini <hbathini-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org> writes:
>>>
>>>> This RFC patch set supports filtering container specific events
>>>> when perf tool is executed inside a container. The patches apply
>>>> cleanly on v4.7.0-rc7
>>>>
>>>> Changes from v1:
>>>> 1/3. Revived earlier approach[1] with cgroup namespace instead
>>>>      of pid namespace
>>>> 2/3. New patch that adds instance support for uprobe events in
>>>>      tracefs filesystem
>>>> 3/3. New patch that adds "newinstance" mount option for tracefs
>>>>      filesystem
>>>        "newinstace" ick no.
>>>
>>> I see no justification anywhere why the perf cgroup is not enough for
>>> this.
>>
>> perf cgroup is not enough for uprobes, because even with perf cgroups a
>> user within a container can still list/delete uprobes registered in
>> other containers.
> 
> Just to be clear, even if there is one cgroup per container?

Yes. Uprobes with perf is two steps. First step is to define/add the
probe (for example: "perf probe /bin/zsh zfree"), which does not require
cgroup argument. Adding a probe writes an entry in
/sys/kernel/debug/tracing/uprobe_events file. uprobes_events file is
shared and hence users in other container can list/delete these entries.

Once added, the second step is to record. We can record by specifying
the cgroup argument with perf record and the events are filtered out
based on the cgroup.

The problem with the first step is handled (in patch 2 and 3) by
creating a separate uprobes_events file per-container by exploiting
already existing "instances" functionality.

Regards,
Aravinda

> 
> Eric
> 

-- 
Regards,
Aravinda