Re: [PATCH] killswitch: add per-function short-circuit mitigation primitive

[Mathieu Desnoyers <mathieu.desnoyers@efficios.com>]

On 2026-05-08 12:13, Sasha Levin wrote:
[...]
>> One possible approach to prevent "footgun" type of killswitch use would
>> be to first apply a statistics collection killswitch handler that does
>> not change the behavior: it checks whether the target function is
>> invoked at all on the system for a given period of time. Then it applies
>> the killswitch if it was not invoked during that period. Overall
>> sequence:
>>
>> - pre-soak killswitch for e.g. 30s, checking whether the function is
>>  invoked at all. (period would be user-configurable)
>> - if no calls were detected, engage killswitch, else report failure to
>>  the user.
>>
>> This should prevent footguns such as trying to killswitch fork, malloc
>> or other core functions which are inherently required.
> 
> Why not just use our good old tracing infra? Set tracepoints where ever you
> want, collect any data you might need, and engage the killswitch when 
> you're
> happy with the data you have?
> 
> It feels a bit weird adding something like this into killswitch.

It really depends on whether you want to include some basic safety nets
directly within killswitch, or leave that entirely to the end user.

I don't have a strong opinion either way. I was just pointing out the
feasibility of a pre-soak sanity check before applying the killswitch.

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com