Access user space data without sleeping

Posted Oct 30, 2020 15:27 UTC (Fri) by walters (subscriber, #7396)
In reply to: Access user space data without sleeping by compudj
Parent article: Relief for insomniac tracepoints

Using BPF for security intersects at KRSI, right?
https://lwn.net/Articles/813261/

Also doing things like looking at file paths should be known to be fairly flawed in general even if it weren't racy just *loading* the path - bind mounts etc. can obscure what you're seeing. The SELinux model of e.g. having `etc_t` for /etc avoids all races and problems with comparing file paths.

Access user space data without sleeping

Posted Oct 30, 2020 16:10 UTC (Fri) by compudj (subscriber, #43335) [Link]

As far as my own comment is concerned, I'm discussing use a trace post-processing approach (or live trace streaming) through LTTng to analyze the behavior of a system either after the fact or in real-time (shortly after it has happened). There it is possible to reconstruct a model of the entire filesystem mounts and path hierarchy anywhere within the trace from a trace post-processing analysis tool.

I did not have the eBPF vs KRSI use-cases in mind when writing that comment.