Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH 2/2] selinux: add attributes to avc tracepoint
From:   Stephen Smalley <stephen.smalley.work@gmail.com>
To:     peter enderborg <peter.enderborg@sony.com>,
        =?UTF-8?Q?Thi=c3=a9baud_Weksteen?= <tweek@google.com>,
        Paul Moore <paul@paul-moore.com>
Cc:     Nick Kralevich <nnk@google.com>,
        Eric Paris <eparis@parisplace.org>,
        Steven Rostedt <rostedt@goodmis.org>,
        Ingo Molnar <mingo@redhat.com>,
        Mauro Carvalho Chehab <mchehab+huawei@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Rob Herring <robh@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
        linux-kernel@vger.kernel.org, selinux@vger.kernel.org
References: <20200806080358.3124505-1-tweek@google.com>
 <20200806080358.3124505-2-tweek@google.com>
 <89d23362-39b9-79e5-84f1-d7b89204ef38@gmail.com>
 <8627d780-0e19-6755-0de5-c686deb0f5de@sony.com>
 <971592b6-5d5f-05d8-d243-b521fe65577d@gmail.com>
Message-ID: <07e2c48d-3918-6ceb-a6b2-4e2f18f9ea01@gmail.com>
Date:   Thu, 6 Aug 2020 09:45:50 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <971592b6-5d5f-05d8-d243-b521fe65577d@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 8/6/20 8:32 AM, Stephen Smalley wrote:

> On 8/6/20 8:24 AM, peter enderborg wrote:
>
>> On 8/6/20 2:11 PM, Stephen Smalley wrote:
>>> On 8/6/20 4:03 AM, Thiébaud Weksteen wrote:
>>>
>>>> From: Peter Enderborg <peter.enderborg@sony.com>
>>>>
>>>> Add further attributes to filter the trace events from AVC.
>>> Please include sample usage and output in the description.
>>>
>>>
>> Im not sure where you want it to be.
>>
>> In the commit message or in a Documentation/trace/events-avc.rst ?
>
> I was just asking for it in the commit message / patch description.  I 
> don't know what is typical for Documentation/trace.

For example, I just took the patches for a spin, running the 
selinux-testsuite under perf like so:

sudo perf record -e avc:selinux_audited -g make test

and then ran:

sudo perf report -g

and a snippet of sample output included:

      6.40%     6.40%  requested=0x800000 denied=0x800000 
audited=0x800000 result=-13 ssid=922 tsid=922 
scontext=unconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023 
tcontext=unconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023 
tclass=capability
             |
             ---0x495641000028933d
                __libc_start_main
                |
                |--4.60%--__GI___ioctl
                |          entry_SYSCALL_64
                |          do_syscall_64
                |          __x64_sys_ioctl
                |          ksys_ioctl
                |          binder_ioctl
                |          binder_set_nice
                |          can_nice
                |          capable
                |          security_capable
                |          cred_has_capability.isra.0
                |          slow_avc_audit
                |          common_lsm_audit
                |          avc_audit_post_callback
                |          avc_audit_post_callback
                |