* [PATCH v5] tracefs: Add read-only eventfs filesystem at /sys/kernel/events
@ 2026-11-03 18:35 Steven Rostedt
2026-11-03 18:51 ` sashiko-bot
0 siblings, 1 reply; 3+ messages in thread
From: Steven Rostedt @ 2026-11-03 18:35 UTC (permalink / raw)
To: LKML, Linux Trace Kernel
Cc: Masami Hiramatsu, Mathieu Desnoyers, Anubhav Shelat
From b6193345c877f0b5a4d326aee0a25b3cd54ae9b6 Mon Sep 17 00:00:00 2001
From: Anubhav Shelat <ashelat@redhat.com>
Date: Mon, 2 Nov 2026 15:27:48 -0500
Subject: [PATCH] tracefs: Add read-only eventfs filesystem at
/sys/kernel/events
Introduce a new read-only pseudo-filesystem "eventfs" mounted at
/sys/kernel/events that exposes trace event format and id files
(mode 0444) to unprivileged users. This allows tools like perf to
discover event formats without requiring access to the full
tracefs/debugfs mount.
The eventfs file system reuses the existing eventfs_inode lazy-lookup
infrastructure. A new set of super_operations
(eventfs_ro_super_operations) shares the tracefs inode allocator so
that eventfs_get_inode() and get_tracefs() work on the RO superblock.
The superblock is manually initialized to ensure the root inode is
allocated with tracefs_alloc_inode, allowing the root to serve
directly as the events directory without another events subdirectory.
Each qualifying event gets a subsystem directory containing format
and id files. The top-level events directory also exposes header_page
and header_event. Similar to tracefs, a change will need to be made in
systemd to mount this filesystem automatically.
[
Steven Rostedt rewrote to use the lookup functions to determine read
only files to show. The struct eventfs_entry now has a "readonly" field
and if it is set, it will be displayed in the read only file system.
The original code [1] duplicated the eventfs_inodes for every event and
subsystem. The new approach uses the existing eventfs_inodes (without
requiring more memory to store them) and uses the eventfs_entry arrays to
show which files are allowed to be read readonly or not.
[1] https://patch.msgid.link/20260715135231.338535-4-ashelat@redhat.com
]
Assisted-by: CLAUDE:claude-opus-4 Apogee
Signed-off-by: Anubhav Shelat <ashelat@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
Changes since v4: https://patch.msgid.link/20261102152748.614ddc8f@gandalf.local.home
- Added eventfs_ro_reconfigure to prevent remounting to anything other
than read-only. (sashiko)
- Updated kerneldocs to add missing arguments (sashiko)
- Fixed updating of mode variable (sashiko)
- Made updating tracefs not affect eventfs (sashiko)
- Remove unused name parameter from eventfs_create_events_ro_copy()
(sashiko)
- Remove duplicate INIT_LIST_HEAD() (again) (sashiko)
- Set the dentry to NULL on error in copy function (sashiko)
- Handle the case of eventfs_create_events_dir() from returning NULL due
to lockdown (sashiko)
fs/tracefs/event_inode.c | 235 ++++++++++++++++++++++++++++++++----
fs/tracefs/inode.c | 21 +++-
fs/tracefs/internal.h | 6 +
include/linux/tracefs.h | 5 +
include/uapi/linux/magic.h | 1 +
kernel/trace/trace_events.c | 17 +++
6 files changed, 261 insertions(+), 24 deletions(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 6457df72173d..f7edf9c58d11 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -16,14 +16,96 @@
*/
#include <linux/fsnotify.h>
#include <linux/fs.h>
+#include <linux/fs_context.h>
#include <linux/namei.h>
#include <linux/workqueue.h>
#include <linux/security.h>
#include <linux/tracefs.h>
+#include <linux/magic.h>
#include <linux/kref.h>
#include <linux/delay.h>
#include "internal.h"
+static struct vfsmount *eventfs_ro_mount;
+static int eventfs_ro_mount_count;
+
+static int eventfs_ro_fill_super(struct super_block *sb, struct fs_context *fc)
+{
+ struct inode *inode;
+ struct dentry *root;
+
+ sb->s_blocksize = PAGE_SIZE;
+ sb->s_blocksize_bits = PAGE_SHIFT;
+ sb->s_magic = EVENTFS_SUPER_MAGIC;
+ sb->s_op = &eventfs_ro_super_operations;
+ sb->s_time_gran = 1;
+ sb->s_flags |= SB_RDONLY;
+
+ inode = new_inode(sb);
+ if (!inode)
+ return -ENOMEM;
+
+ inode->i_ino = 1;
+ inode->i_mode = S_IFDIR | 0555;
+ simple_inode_init_ts(inode);
+ inode->i_op = &simple_dir_inode_operations;
+ inode->i_fop = &simple_dir_operations;
+ set_nlink(inode, 2);
+
+ set_default_d_op(sb, &tracefs_dentry_operations);
+
+ root = d_make_root(inode);
+ if (!root)
+ return -ENOMEM;
+
+ sb->s_root = root;
+
+ return 0;
+}
+
+/* The eventfs_ro is always read-only */
+static int eventfs_ro_reconfigure(struct fs_context *fc)
+{
+ sync_filesystem(fc->root->d_sb);
+ fc->sb_flags |= SB_RDONLY;
+ return 0;
+}
+
+static int eventfs_ro_get_tree(struct fs_context *fc)
+{
+ return get_tree_single(fc, eventfs_ro_fill_super);
+}
+
+static const struct fs_context_operations eventfs_ro_context_ops = {
+ .get_tree = eventfs_ro_get_tree,
+ .reconfigure = eventfs_ro_reconfigure,
+};
+
+static int eventfs_ro_init_fs_context(struct fs_context *fc)
+{
+ fc->ops = &eventfs_ro_context_ops;
+ return 0;
+}
+
+struct file_system_type eventfs_ro_fs_type = {
+ .owner = THIS_MODULE,
+ .name = "eventfs",
+ .init_fs_context = eventfs_ro_init_fs_context,
+ .kill_sb = kill_anon_super,
+};
+
+struct dentry *eventfs_ro_get_root(void)
+{
+ int error;
+
+ error = simple_pin_fs(&eventfs_ro_fs_type, &eventfs_ro_mount,
+ &eventfs_ro_mount_count);
+ if (error)
+ return ERR_PTR(error);
+
+ return dget(eventfs_ro_mount->mnt_root);
+}
+
/*
* eventfs_mutex protects the eventfs_inode (ei) dentry. Any access
* to the ei->dentry must be done under this mutex and after checking
@@ -169,7 +251,11 @@ static inline struct eventfs_inode *get_ei(struct eventfs_inode *ei)
static struct dentry *eventfs_root_lookup(struct inode *dir,
struct dentry *dentry,
unsigned int flags);
+static struct dentry *eventfs_root_lookup_ro(struct inode *dir,
+ struct dentry *dentry,
+ unsigned int flags);
static int eventfs_iterate(struct file *file, struct dir_context *ctx);
+static int eventfs_ro_iterate(struct file *file, struct dir_context *ctx);
static void update_attr(struct eventfs_attr *attr, struct iattr *iattr)
{
@@ -247,6 +333,10 @@ static const struct inode_operations eventfs_dir_inode_operations = {
.setattr = eventfs_set_attr,
};
+static const struct inode_operations eventfs_ro_dir_inode_operations = {
+ .lookup = eventfs_root_lookup_ro,
+};
+
static const struct inode_operations eventfs_file_inode_operations = {
.setattr = eventfs_set_attr,
};
@@ -257,6 +347,12 @@ static const struct file_operations eventfs_file_operations = {
.llseek = generic_file_llseek,
};
+static const struct file_operations eventfs_ro_file_operations = {
+ .read = generic_read_dir,
+ .iterate_shared = eventfs_ro_iterate,
+ .llseek = generic_file_llseek,
+};
+
static void eventfs_set_attrs(struct eventfs_inode *ei, bool update_uid, kuid_t uid,
bool update_gid, kgid_t gid, int level)
{
@@ -316,12 +412,17 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid)
}
static void update_inode_attr(struct inode *inode, umode_t mode,
- struct eventfs_attr *attr, struct eventfs_root_inode *rei)
+ struct eventfs_attr *attr, struct eventfs_root_inode *rei,
+ bool ro)
{
+ inode->i_mode = mode;
+
+ /* The read-only version does not allow updates to owership or permissions */
+ if (ro)
+ return;
+
if (attr && attr->mode & EVENTFS_SAVE_MODE)
inode->i_mode = attr->mode & EVENTFS_MODE_MASK;
- else
- inode->i_mode = mode;
if (attr && attr->mode & EVENTFS_SAVE_UID)
inode->i_uid = attr->uid;
@@ -335,7 +436,7 @@ static void update_inode_attr(struct inode *inode, umode_t mode,
}
static struct inode *eventfs_get_inode(struct dentry *dentry, struct eventfs_attr *attr,
- umode_t mode, struct eventfs_inode *ei)
+ umode_t mode, struct eventfs_inode *ei, bool ro)
{
struct eventfs_root_inode *rei;
struct eventfs_inode *pei;
@@ -359,7 +460,7 @@ static struct inode *eventfs_get_inode(struct dentry *dentry, struct eventfs_att
rei = get_root_inode(pei);
- update_inode_attr(inode, mode, attr, rei);
+ update_inode_attr(inode, mode, attr, rei, ro);
return inode;
}
@@ -372,6 +473,7 @@ static struct inode *eventfs_get_inode(struct dentry *dentry, struct eventfs_att
* @attr: saved attributes changed by user
* @data: something that the caller will want to get to later on.
* @fop: struct file_operations that should be used for this file.
+ * @ro: Denote if this lookup is for the read-only version.
*
* This function creates a dentry that represents a file in the eventsfs_inode
* directory. The inode.i_private pointer will point to @data in the open()
@@ -382,7 +484,8 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
umode_t mode,
struct eventfs_attr *attr,
void *data,
- const struct file_operations *fop)
+ const struct file_operations *fop,
+ bool ro)
{
struct inode *inode;
@@ -393,11 +496,13 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
return ERR_PTR(-EIO);
/* Only directories have ti->private set to an ei, not files */
- inode = eventfs_get_inode(dentry, attr, mode, NULL);
+ inode = eventfs_get_inode(dentry, attr, mode, NULL, ro);
if (unlikely(!inode))
return ERR_PTR(-ENOMEM);
- inode->i_op = &eventfs_file_inode_operations;
+ /* Read only does not allow setting of attributes */
+ if (!ro)
+ inode->i_op = &eventfs_file_inode_operations;
inode->i_fop = fop;
inode->i_private = data;
@@ -415,22 +520,28 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
* @dentry: the directory to look up
* @pei: Pointer to the parent eventfs_inode if available
* @ei: the eventfs_inode that represents the directory to create
+ * @ro: boolean to denote if this lookup is for the read-only version
*
* This function will look up a dentry for a directory represented by
* a eventfs_inode.
*/
static struct dentry *lookup_dir_entry(struct dentry *dentry,
- struct eventfs_inode *pei, struct eventfs_inode *ei)
+ struct eventfs_inode *pei, struct eventfs_inode *ei, bool ro)
{
struct inode *inode;
umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
- inode = eventfs_get_inode(dentry, &ei->attr, mode, ei);
+ inode = eventfs_get_inode(dentry, &ei->attr, mode, ei, ro);
if (unlikely(!inode))
return ERR_PTR(-ENOMEM);
- inode->i_op = &eventfs_dir_inode_operations;
- inode->i_fop = &eventfs_file_operations;
+ if (ro) {
+ inode->i_op = &eventfs_ro_dir_inode_operations;
+ inode->i_fop = &eventfs_ro_file_operations;
+ } else {
+ inode->i_op = &eventfs_dir_inode_operations;
+ inode->i_fop = &eventfs_file_operations;
+ }
/* All directories will have the same inode number */
inode->i_ino = eventfs_dir_ino(ei);
@@ -501,6 +612,7 @@ void eventfs_d_release(struct dentry *dentry)
* @mode: The mode of the file.
* @data: The data to use to set the inode of the file with on open()
* @fops: The fops of the file to be created.
+ * @ro: Denote if this lookup is for the read-only version
*
* This function creates a dentry for a file associated with an
* eventfs_inode @ei. It uses the entry attributes specified by @idx,
@@ -514,14 +626,21 @@ static struct dentry *
lookup_file_dentry(struct dentry *dentry,
struct eventfs_inode *ei, int idx,
umode_t mode, void *data,
- const struct file_operations *fops)
+ const struct file_operations *fops, bool ro)
{
struct eventfs_attr *attr = NULL;
- if (ei->entry_attrs)
+ /*
+ * Read-only files gives all users read access,
+ * but also should make sure this is not writable.
+ * Read-only also does not allow modified attributes.
+ */
+ if (ro)
+ mode = (mode & ~0222) | 0444;
+ else if (ei->entry_attrs)
attr = &ei->entry_attrs[idx];
- return lookup_file(ei, dentry, mode, attr, data, fops);
+ return lookup_file(ei, dentry, mode, attr, data, fops, ro);
}
/**
@@ -529,14 +648,16 @@ lookup_file_dentry(struct dentry *dentry,
* @dir: in which a lookup is being done
* @dentry: file/dir dentry
* @flags: Just passed to simple_lookup()
+ * @ro: Denote if this is from a read-only eventfs
*
* Used to create dynamic file/dir with-in @dir, search with-in @ei
* list, if @dentry found go ahead and create the file/dir
*/
-static struct dentry *eventfs_root_lookup(struct inode *dir,
- struct dentry *dentry,
- unsigned int flags)
+static struct dentry *__eventfs_root_lookup(struct inode *dir,
+ struct dentry *dentry,
+ unsigned int flags,
+ bool ro)
{
struct eventfs_inode *ei_child;
struct tracefs_inode *ti;
@@ -559,7 +680,7 @@ static struct dentry *eventfs_root_lookup(struct inode *dir,
/* A child is freed and removed from the list at the same time */
if (WARN_ON_ONCE(ei_child->is_freed))
return NULL;
- return lookup_dir_entry(dentry, ei, ei_child);
+ return lookup_dir_entry(dentry, ei, ei_child, ro);
}
for (int i = 0; i < ei->nr_entries; i++) {
@@ -571,20 +692,37 @@ static struct dentry *eventfs_root_lookup(struct inode *dir,
if (strcmp(name, entry->name) != 0)
continue;
+ if (ro && !entry->read_only)
+ return NULL;
+
data = ei->data;
if (entry->callback(name, &mode, &data, &fops) <= 0)
return NULL;
- return lookup_file_dentry(dentry, ei, i, mode, data, fops);
+ return lookup_file_dentry(dentry, ei, i, mode, data, fops, ro);
}
return NULL;
}
+static struct dentry *eventfs_root_lookup(struct inode *dir,
+ struct dentry *dentry,
+ unsigned int flags)
+{
+ return __eventfs_root_lookup(dir, dentry, flags, false);
+}
+
+static struct dentry *eventfs_root_lookup_ro(struct inode *dir,
+ struct dentry *dentry,
+ unsigned int flags)
+{
+ return __eventfs_root_lookup(dir, dentry, flags, true);
+}
+
/*
* Walk the children of a eventfs_inode to fill in getdents().
*/
-static int eventfs_iterate(struct file *file, struct dir_context *ctx)
+static int __eventfs_iterate(struct file *file, struct dir_context *ctx, bool ro)
{
const struct file_operations *fops;
struct inode *f_inode = file_inode(file);
@@ -630,6 +768,9 @@ static int eventfs_iterate(struct file *file, struct dir_context *ctx)
entry = &ei->entries[i];
name = entry->name;
+ if (ro && !entry->read_only)
+ continue;
+
/* If ei->is_freed then just bail here, nothing more to do */
scoped_guard(mutex, &eventfs_mutex) {
if (ei->is_freed)
@@ -688,6 +829,16 @@ static int eventfs_iterate(struct file *file, struct dir_context *ctx)
return 1;
}
+static int eventfs_iterate(struct file *file, struct dir_context *ctx)
+{
+ return __eventfs_iterate(file, ctx, false);
+}
+
+static int eventfs_ro_iterate(struct file *file, struct dir_context *ctx)
+{
+ return __eventfs_iterate(file, ctx, true);
+}
+
/**
* eventfs_create_dir - Create the eventfs_inode for this directory
* @name: The name of the directory to create.
@@ -845,6 +996,48 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
return ERR_PTR(-ENOMEM);
}
+/**
+ * eventfs_create_events_ro_copy - create a read-only events directory
+ * @ei: The eventfs_inode to use to create a read-only copy from
+ *
+ * This function configures the eventfs filesystem root as a read-only
+ * trace event directory using the existing eventfs_inode lazy-lookup
+ * infrastructure.
+ */
+int eventfs_create_events_ro_copy(struct eventfs_inode *ei)
+{
+ static struct dentry *dentry;
+ struct tracefs_inode *ti;
+ struct inode *inode;
+ int ret;
+
+ /* Can only be called once. */
+ if (dentry)
+ return -EBUSY;
+
+ /* Reference acquired but never freed */
+ dentry = eventfs_ro_get_root();
+ if (IS_ERR(dentry)) {
+ ret = PTR_ERR(dentry);
+ dentry = NULL;
+ return ret;
+ }
+
+ inode = d_inode(dentry);
+
+ ti = get_tracefs(inode);
+ ti->flags |= TRACEFS_EVENT_INODE;
+ ti->private = ei;
+
+ inode->i_op = &eventfs_ro_dir_inode_operations;
+ inode->i_fop = &eventfs_ro_file_operations;
+
+ /* This is never freed */
+ dentry->d_fsdata = get_ei(ei);
+
+ return 0;
+}
+
/**
* eventfs_remove_rec - remove eventfs dir or file from list
* @ei: eventfs_inode to be removed.
diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
index 5020365ca704..555af5402adc 100644
--- a/fs/tracefs/inode.c
+++ b/fs/tracefs/inode.c
@@ -423,6 +423,14 @@ static const struct super_operations tracefs_super_operations = {
.show_options = tracefs_show_options,
};
+const struct super_operations eventfs_ro_super_operations = {
+ .alloc_inode = tracefs_alloc_inode,
+ .free_inode = tracefs_free_inode,
+ .destroy_inode = tracefs_destroy_inode,
+ .drop_inode = tracefs_drop_inode,
+ .statfs = simple_statfs,
+};
+
/*
* It would be cleaner if eventfs had its own dentry ops.
*
@@ -455,7 +463,7 @@ static int tracefs_d_delete(const struct dentry *dentry)
return dentry->d_fsdata == NULL;
}
-static const struct dentry_operations tracefs_dentry_operations = {
+const struct dentry_operations tracefs_dentry_operations = {
.d_revalidate = tracefs_d_revalidate,
.d_release = tracefs_d_release,
.d_delete = tracefs_d_delete,
@@ -801,8 +809,15 @@ static int __init tracefs_init(void)
return -EINVAL;
retval = register_filesystem(&trace_fs_type);
- if (!retval)
- tracefs_registered = true;
+ if (retval)
+ return retval;
+ tracefs_registered = true;
+
+ retval = sysfs_create_mount_point(kernel_kobj, "events");
+ if (retval)
+ return retval;
+
+ retval = register_filesystem(&eventfs_ro_fs_type);
return retval;
}
diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
index c61481d04c8e..c92376bc3121 100644
--- a/fs/tracefs/internal.h
+++ b/fs/tracefs/internal.h
@@ -2,6 +2,10 @@
#ifndef _TRACEFS_INTERNAL_H
#define _TRACEFS_INTERNAL_H
+extern const struct dentry_operations tracefs_dentry_operations;
+extern const struct super_operations eventfs_ro_super_operations;
+extern struct file_system_type eventfs_ro_fs_type;
+
enum {
TRACEFS_EVENT_INODE = BIT(1),
TRACEFS_GID_PERM_SET = BIT(2),
@@ -73,6 +77,8 @@ struct dentry *tracefs_end_creating(struct dentry *dentry);
struct dentry *tracefs_failed_creating(struct dentry *dentry);
struct inode *tracefs_get_inode(struct super_block *sb);
+struct dentry *eventfs_ro_get_root(void);
+
void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid);
void eventfs_d_release(struct dentry *dentry);
diff --git a/include/linux/tracefs.h b/include/linux/tracefs.h
index bc354d340046..61b0ef3a5efd 100644
--- a/include/linux/tracefs.h
+++ b/include/linux/tracefs.h
@@ -68,6 +68,8 @@ typedef void (*eventfs_release)(const char *name, void *data);
* struct eventfs_entry - dynamically created eventfs file call back handler
* @name: Then name of the dynamic file in an eventfs directory
* @callback: The callback to get the fops of the file when it is created
+ * @release: The callback when the fops of the file is released
+ * @read_only: Set if this file can be part of the read-only eventfs file system
*
* See evenfs_callback() typedef for how to set up @callback.
*/
@@ -75,6 +77,7 @@ struct eventfs_entry {
const char *name;
eventfs_callback callback;
eventfs_release release;
+ bool read_only;
};
struct eventfs_inode;
@@ -87,6 +90,8 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
const struct eventfs_entry *entries,
int size, void *data);
+int eventfs_create_events_ro_copy(struct eventfs_inode *ei);
+
void eventfs_remove_events_dir(struct eventfs_inode *ei);
void eventfs_remove_dir(struct eventfs_inode *ei);
diff --git a/include/uapi/linux/magic.h b/include/uapi/linux/magic.h
index 66a91c8b1cb9..521916f64dee 100644
--- a/include/uapi/linux/magic.h
+++ b/include/uapi/linux/magic.h
@@ -76,6 +76,7 @@
#define STACK_END_MAGIC 0x57AC6E9D
#define TRACEFS_MAGIC 0x74726163
+#define EVENTFS_SUPER_MAGIC 0x65766673
#define V9FS_MAGIC 0x01021997
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 49d135bc2fbf..1d2bd2a9580f 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3298,17 +3298,20 @@ event_create_dir(struct eventfs_inode *parent, struct trace_event_file *file)
{
.name = "format",
.callback = event_callback,
+ .read_only = true,
},
#ifdef CONFIG_PERF_EVENTS
{
.name = "id",
.callback = event_callback,
+ .read_only = true,
},
#endif
#ifdef CONFIG_BPF_EVENTS
{
.name = "btf_ids",
.callback = event_callback,
+ .read_only = true,
},
#endif
#define NR_RO_EVENT_ENTRIES (1 + IS_ENABLED(CONFIG_PERF_EVENTS) + \
@@ -4722,6 +4725,7 @@ static int events_callback(const char *name, umode_t *mode, void **data,
static int
create_event_toplevel_files(struct dentry *parent, struct trace_array *tr)
{
+ static bool event_dir_ro_created;
struct eventfs_inode *e_events;
struct dentry *entry;
int nr_entries;
@@ -4729,10 +4733,12 @@ create_event_toplevel_files(struct dentry *parent, struct trace_array *tr)
{
.name = "header_page",
.callback = events_callback,
+ .read_only = true,
},
{
.name = "header_event",
.callback = events_callback,
+ .read_only = true,
},
#define NR_RO_TOP_ENTRIES 2
/* Readonly files must be above this line and counted by NR_RO_TOP_ENTRIES. */
@@ -4773,8 +4779,19 @@ create_event_toplevel_files(struct dentry *parent, struct trace_array *tr)
return -ENOMEM;
}
+ /* Lockdown causes e_events to be NULL*/
+ if (!e_events)
+ return -EPERM;
+
tr->event_dir = e_events;
+ if (!event_dir_ro_created && (tr->flags & TRACE_ARRAY_FL_GLOBAL)) {
+ int ret;
+
+ ret = eventfs_create_events_ro_copy(e_events);
+ if (!ret)
+ event_dir_ro_created = true;
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v5] tracefs: Add read-only eventfs filesystem at /sys/kernel/events
2026-11-03 18:35 [PATCH v5] tracefs: Add read-only eventfs filesystem at /sys/kernel/events Steven Rostedt
@ 2026-11-03 18:51 ` sashiko-bot
2026-11-03 20:19 ` Steven Rostedt
0 siblings, 1 reply; 3+ messages in thread
From: sashiko-bot @ 2026-11-03 18:51 UTC (permalink / raw)
To: Steven Rostedt, Linux Trace Kernel
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] tracefs: tracefs_apply_options() overwrites eventfs_ro inode ownership
- [Medium] tracefs: eventfs_ro_fill_super() sets i_nlink to 2 on dynamic eventfs root
- [Low] tracefs: mismatched kernel-doc function name for __eventfs_root_lookup()
--
commit 8a085766e708c607f0750dab297b23f146dfe8b9
Author: Anubhav Shelat <ashelat@redhat.com>
tracefs: Add read-only eventfs filesystem at /sys/kernel/events
This commit introduces a read-only eventfs pseudo-filesystem mounted at
/sys/kernel/events that exposes trace event format and id files with mode
0444 to unprivileged users. It reuses the existing eventfs_inode
lazy-lookup infrastructure and tracefs inode allocator on a separate
read-only superblock.
> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
> index 6e3513b13cfa2..43ae382cfbbfc 100644
> --- a/fs/tracefs/event_inode.c
> +++ b/fs/tracefs/event_inode.c
> @@ -16,14 +16,96 @@
> */
> #include <linux/fsnotify.h>
> #include <linux/fs.h>
> +#include <linux/fs_context.h>
> #include <linux/namei.h>
> #include <linux/workqueue.h>
> #include <linux/security.h>
> #include <linux/tracefs.h>
> +#include <linux/magic.h>
> #include <linux/kref.h>
> #include <linux/delay.h>
> #include "internal.h"
>
> +static struct vfsmount *eventfs_ro_mount;
> +static int eventfs_ro_mount_count;
> +
> +static int eventfs_ro_fill_super(struct super_block *sb, struct fs_context *fc)
> +{
> + struct inode *inode;
> + struct dentry *root;
> +
> + sb->s_blocksize = PAGE_SIZE;
> + sb->s_blocksize_bits = PAGE_SHIFT;
> + sb->s_magic = EVENTFS_SUPER_MAGIC;
> + sb->s_op = &eventfs_ro_super_operations;
> + sb->s_time_gran = 1;
> + sb->s_flags |= SB_RDONLY;
> +
> + inode = new_inode(sb);
> + if (!inode)
> + return -ENOMEM;
> +
> + inode->i_ino = 1;
> + inode->i_mode = S_IFDIR | 0555;
> + simple_inode_init_ts(inode);
> + inode->i_op = &simple_dir_inode_operations;
> + inode->i_fop = &simple_dir_operations;
> + set_nlink(inode, 2);
[Severity: Medium]
Should the root inode keep i_nlink at 1 rather than calling
set_nlink(inode, 2) in eventfs_ro_fill_super()?
When eventfs_create_events_ro_copy() later configures this root inode as the
top-level eventfs directory with eventfs_ro_dir_inode_operations and
eventfs_ro_file_operations, its subsystem subdirectories are created
dynamically on demand in lookup_dir_entry() without incrementing the parent
directory link count.
As noted in eventfs_create_events_dir(), eventfs directories keep i_nlink == 1
so userspace tools do not trust the link count:
/*
* Keep all eventfs directories with i_nlink == 1.
* Due to the dynamic nature of the dentry creations and not
* wanting to add a pointer to the parent eventfs_inode in the
* eventfs_inode structure, keeping the i_nlink in sync with the
* number of directories would cause too much complexity for
* something not worth much. Keeping directory links at 1
* tells userspace not to trust the link number.
*/
With i_nlink set to 2 on /sys/kernel/events, won't userspace directory
traversal tools such as find and fts assume the directory has no
subdirectories (st_nlink == 2) and skip recursing into the event subsystem
directories?
[ ... ]
> @@ -308,12 +404,17 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid)
> }
>
> static void update_inode_attr(struct inode *inode, umode_t mode,
> - struct eventfs_attr *attr, struct eventfs_root_inode *rei)
> + struct eventfs_attr *attr, struct eventfs_root_inode *rei,
> + bool ro)
> {
> + inode->i_mode = mode;
> +
> + /* The read-only version does not allow updates to owership or permissions */
> + if (ro)
> + return;
> +
> if (attr && attr->mode & EVENTFS_SAVE_MODE)
> inode->i_mode = attr->mode & EVENTFS_MODE_MASK;
> - else
> - inode->i_mode = mode;
>
> if (attr && attr->mode & EVENTFS_SAVE_UID)
> inode->i_uid = attr->uid;
[ ... ]
> @@ -407,22 +512,28 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
> * @dentry: the directory to look up
> * @pei: Pointer to the parent eventfs_inode if available
> * @ei: the eventfs_inode that represents the directory to create
> + * @ro: boolean to denote if this lookup is for the read-only version
> *
> * This function will look up a dentry for a directory represented by
> * a eventfs_inode.
> */
> static struct dentry *lookup_dir_entry(struct dentry *dentry,
> - struct eventfs_inode *pei, struct eventfs_inode *ei)
> + struct eventfs_inode *pei, struct eventfs_inode *ei, bool ro)
> {
> struct inode *inode;
> umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
>
> - inode = eventfs_get_inode(dentry, &ei->attr, mode, ei);
> + inode = eventfs_get_inode(dentry, &ei->attr, mode, ei, ro);
> if (unlikely(!inode))
> return ERR_PTR(-ENOMEM);
>
> - inode->i_op = &eventfs_dir_inode_operations;
> - inode->i_fop = &eventfs_file_operations;
> + if (ro) {
> + inode->i_op = &eventfs_ro_dir_inode_operations;
> + inode->i_fop = &eventfs_ro_file_operations;
> + } else {
> + inode->i_op = &eventfs_dir_inode_operations;
> + inode->i_fop = &eventfs_file_operations;
> + }
[ ... ]
> @@ -521,14 +640,16 @@ lookup_file_dentry(struct dentry *dentry,
> * @dir: in which a lookup is being done
> * @dentry: file/dir dentry
> * @flags: Just passed to simple_lookup()
> + * @ro: Denote if this is from a read-only eventfs
> *
> * Used to create dynamic file/dir with-in @dir, search with-in @ei
> * list, if @dentry found go ahead and create the file/dir
> */
>
> -static struct dentry *eventfs_root_lookup(struct inode *dir,
> - struct dentry *dentry,
> - unsigned int flags)
> +static struct dentry *__eventfs_root_lookup(struct inode *dir,
> + struct dentry *dentry,
> + unsigned int flags,
> + bool ro)
[Severity: Low]
This isn't a bug, but since eventfs_root_lookup() was renamed to
__eventfs_root_lookup(), should the function name in the kernel-doc comment
header above it also be updated to __eventfs_root_lookup to avoid a W=1
kernel-doc warning?
[ ... ]
> diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
> index f3d6188a3b7b2..dafa0d587f04c 100644
> --- a/fs/tracefs/inode.c
> +++ b/fs/tracefs/inode.c
> @@ -423,6 +423,14 @@ static const struct super_operations tracefs_super_operations = {
> .show_options = tracefs_show_options,
> };
>
> +const struct super_operations eventfs_ro_super_operations = {
> + .alloc_inode = tracefs_alloc_inode,
> + .free_inode = tracefs_free_inode,
> + .destroy_inode = tracefs_destroy_inode,
> + .drop_inode = tracefs_drop_inode,
> + .statfs = simple_statfs,
> +};
[Severity: Medium]
As reported by Sashiko on v4 [1], because eventfs_ro_super_operations uses
tracefs_alloc_inode, all inodes allocated on the read-only eventfs
superblock (including the pinned root inode configured by
eventfs_create_events_ro_copy() and any cached subdirectories or files) are
linked into the global tracefs_inodes list.
While update_inode_attr() now returns early when ro is true during lookup,
when tracefs is mounted or remounted with uid= or gid= options,
tracefs_apply_options() still walks the global tracefs_inodes list without
checking if the inode belongs to the tracefs superblock:
fs/tracefs/inode.c:tracefs_apply_options() {
...
list_for_each_entry_rcu(ti, &tracefs_inodes, list) {
if (update_uid) {
ti->flags &= ~TRACEFS_UID_PERM_SET;
ti->vfs_inode.i_uid = fsi->uid;
}
if (update_gid) {
ti->flags &= ~TRACEFS_GID_PERM_SET;
ti->vfs_inode.i_gid = fsi->gid;
}
if (ti->flags & TRACEFS_EVENT_INODE)
eventfs_remount(ti, update_uid, update_gid);
}
...
}
Won't mounting or remounting tracefs with uid= or gid= overwrite i_uid and
i_gid on the pinned /sys/kernel/events root inode and all currently cached
eventfs_ro inodes, as well as invoke eventfs_remount() a second time on the
shared eventfs_inode via the eventfs_ro root inode?
Also, in lookup_dir_entry(), mode is initialized to:
umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
When ro is true, should lookup_dir_entry() clear S_IWUSR (or use 0555 to
match the root inode in eventfs_ro_fill_super()) so subdirectories in the
read-only eventfs mount do not report 0755 permissions?
[1] https://lore.kernel.org/r/sashiko-outbox-194145@kernel.org
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261103133517.6e54a8db@gandalf.local.home?part=1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v5] tracefs: Add read-only eventfs filesystem at /sys/kernel/events
2026-11-03 18:51 ` sashiko-bot
@ 2026-11-03 20:19 ` Steven Rostedt
0 siblings, 0 replies; 3+ messages in thread
From: Steven Rostedt @ 2026-11-03 20:19 UTC (permalink / raw)
To: sashiko-bot; +Cc: sashiko-reviews, Linux Trace Kernel
On Tue, 03 Nov 2026 18:51:19 +0000
sashiko-bot@kernel.org wrote:
> > + inode->i_ino = 1;
> > + inode->i_mode = S_IFDIR | 0555;
> > + simple_inode_init_ts(inode);
> > + inode->i_op = &simple_dir_inode_operations;
> > + inode->i_fop = &simple_dir_operations;
> > + set_nlink(inode, 2);
>
> [Severity: Medium]
> Should the root inode keep i_nlink at 1 rather than calling
> set_nlink(inode, 2) in eventfs_ro_fill_super()?
>
> When eventfs_create_events_ro_copy() later configures this root inode as the
> top-level eventfs directory with eventfs_ro_dir_inode_operations and
> eventfs_ro_file_operations, its subsystem subdirectories are created
> dynamically on demand in lookup_dir_entry() without incrementing the parent
> directory link count.
>
> As noted in eventfs_create_events_dir(), eventfs directories keep i_nlink == 1
> so userspace tools do not trust the link count:
>
> /*
> * Keep all eventfs directories with i_nlink == 1.
> * Due to the dynamic nature of the dentry creations and not
> * wanting to add a pointer to the parent eventfs_inode in the
> * eventfs_inode structure, keeping the i_nlink in sync with the
> * number of directories would cause too much complexity for
> * something not worth much. Keeping directory links at 1
> * tells userspace not to trust the link number.
> */
>
> With i_nlink set to 2 on /sys/kernel/events, won't userspace directory
> traversal tools such as find and fts assume the directory has no
> subdirectories (st_nlink == 2) and skip recursing into the event subsystem
> directories?
Good point. Will update.
>
> [ ... ]
>
> > @@ -308,12 +404,17 @@ void eventfs_remount(struct tracefs_inode *ti, bool update_uid, bool update_gid)
> > }
> >
> > static void update_inode_attr(struct inode *inode, umode_t mode,
> > - struct eventfs_attr *attr, struct eventfs_root_inode *rei)
> > + struct eventfs_attr *attr, struct eventfs_root_inode *rei,
> > + bool ro)
> > {
> > + inode->i_mode = mode;
> > +
> > + /* The read-only version does not allow updates to owership or permissions */
> > + if (ro)
> > + return;
> > +
> > if (attr && attr->mode & EVENTFS_SAVE_MODE)
> > inode->i_mode = attr->mode & EVENTFS_MODE_MASK;
> > - else
> > - inode->i_mode = mode;
> >
> > if (attr && attr->mode & EVENTFS_SAVE_UID)
> > inode->i_uid = attr->uid;
>
> [ ... ]
>
> > @@ -407,22 +512,28 @@ static struct dentry *lookup_file(struct eventfs_inode *parent_ei,
> > * @dentry: the directory to look up
> > * @pei: Pointer to the parent eventfs_inode if available
> > * @ei: the eventfs_inode that represents the directory to create
> > + * @ro: boolean to denote if this lookup is for the read-only version
> > *
> > * This function will look up a dentry for a directory represented by
> > * a eventfs_inode.
> > */
> > static struct dentry *lookup_dir_entry(struct dentry *dentry,
> > - struct eventfs_inode *pei, struct eventfs_inode *ei)
> > + struct eventfs_inode *pei, struct eventfs_inode *ei, bool ro)
> > {
> > struct inode *inode;
> > umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
> >
> > - inode = eventfs_get_inode(dentry, &ei->attr, mode, ei);
> > + inode = eventfs_get_inode(dentry, &ei->attr, mode, ei, ro);
> > if (unlikely(!inode))
> > return ERR_PTR(-ENOMEM);
> >
> > - inode->i_op = &eventfs_dir_inode_operations;
> > - inode->i_fop = &eventfs_file_operations;
> > + if (ro) {
> > + inode->i_op = &eventfs_ro_dir_inode_operations;
> > + inode->i_fop = &eventfs_ro_file_operations;
> > + } else {
> > + inode->i_op = &eventfs_dir_inode_operations;
> > + inode->i_fop = &eventfs_file_operations;
> > + }
>
> [ ... ]
>
> > @@ -521,14 +640,16 @@ lookup_file_dentry(struct dentry *dentry,
> > * @dir: in which a lookup is being done
> > * @dentry: file/dir dentry
> > * @flags: Just passed to simple_lookup()
> > + * @ro: Denote if this is from a read-only eventfs
> > *
> > * Used to create dynamic file/dir with-in @dir, search with-in @ei
> > * list, if @dentry found go ahead and create the file/dir
> > */
> >
> > -static struct dentry *eventfs_root_lookup(struct inode *dir,
> > - struct dentry *dentry,
> > - unsigned int flags)
> > +static struct dentry *__eventfs_root_lookup(struct inode *dir,
> > + struct dentry *dentry,
> > + unsigned int flags,
> > + bool ro)
>
> [Severity: Low]
> This isn't a bug, but since eventfs_root_lookup() was renamed to
> __eventfs_root_lookup(), should the function name in the kernel-doc comment
> header above it also be updated to __eventfs_root_lookup to avoid a W=1
> kernel-doc warning?
Hmm, I rather keep it as is. Yeah, W=1 may warn, but it's still the first
function. Maybe I'll update this later as a cleanup.
>
> [ ... ]
>
> > diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
> > index f3d6188a3b7b2..dafa0d587f04c 100644
> > --- a/fs/tracefs/inode.c
> > +++ b/fs/tracefs/inode.c
> > @@ -423,6 +423,14 @@ static const struct super_operations tracefs_super_operations = {
> > .show_options = tracefs_show_options,
> > };
> >
> > +const struct super_operations eventfs_ro_super_operations = {
> > + .alloc_inode = tracefs_alloc_inode,
> > + .free_inode = tracefs_free_inode,
> > + .destroy_inode = tracefs_destroy_inode,
> > + .drop_inode = tracefs_drop_inode,
> > + .statfs = simple_statfs,
> > +};
>
> [Severity: Medium]
> As reported by Sashiko on v4 [1], because eventfs_ro_super_operations uses
> tracefs_alloc_inode, all inodes allocated on the read-only eventfs
> superblock (including the pinned root inode configured by
> eventfs_create_events_ro_copy() and any cached subdirectories or files) are
> linked into the global tracefs_inodes list.
>
> While update_inode_attr() now returns early when ro is true during lookup,
> when tracefs is mounted or remounted with uid= or gid= options,
> tracefs_apply_options() still walks the global tracefs_inodes list without
> checking if the inode belongs to the tracefs superblock:
>
> fs/tracefs/inode.c:tracefs_apply_options() {
> ...
> list_for_each_entry_rcu(ti, &tracefs_inodes, list) {
> if (update_uid) {
> ti->flags &= ~TRACEFS_UID_PERM_SET;
> ti->vfs_inode.i_uid = fsi->uid;
> }
>
> if (update_gid) {
> ti->flags &= ~TRACEFS_GID_PERM_SET;
> ti->vfs_inode.i_gid = fsi->gid;
> }
>
> if (ti->flags & TRACEFS_EVENT_INODE)
> eventfs_remount(ti, update_uid, update_gid);
> }
> ...
> }
>
> Won't mounting or remounting tracefs with uid= or gid= overwrite i_uid and
> i_gid on the pinned /sys/kernel/events root inode and all currently cached
> eventfs_ro inodes, as well as invoke eventfs_remount() a second time on the
> shared eventfs_inode via the eventfs_ro root inode?
OK, I'll add a flag to skip read-only event inodes.
>
> Also, in lookup_dir_entry(), mode is initialized to:
>
> umode_t mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
>
> When ro is true, should lookup_dir_entry() clear S_IWUSR (or use 0555 to
> match the root inode in eventfs_ro_fill_super()) so subdirectories in the
> read-only eventfs mount do not report 0755 permissions?
Honestly, all of tracefs directories should be read only except for the
instances directory. I may update that as a separate patch.
-- Steve
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-03 20:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-03 18:35 [PATCH v5] tracefs: Add read-only eventfs filesystem at /sys/kernel/events Steven Rostedt
2026-11-03 18:51 ` sashiko-bot
2026-11-03 20:19 ` Steven Rostedt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox