Re: [PATCH 2/2] selinux: add attributes to avc tracepoint

[Stephen Smalley]

On 8/6/20 8:32 AM, Stephen Smalley wrote:

> On 8/6/20 8:24 AM, peter enderborg wrote:
>
> > On 8/6/20 2:11 PM, Stephen Smalley wrote:
> > > On 8/6/20 4:03 AM, Thiébaud Weksteen wrote:
> > >
> > > > From: Peter Enderborg <peter.enderborg@xxxxxxxx>
> > > >
> > > > Add further attributes to filter the trace events from AVC.
> > > Please include sample usage and output in the description.
> > Im not sure where you want it to be.
> >
> > In the commit message or in a Documentation/trace/events-avc.rst ?
>
> I was just asking for it in the commit message / patch description.  I 
> don't know what is typical for Documentation/trace.

For example, I just took the patches for a spin, running the 
selinux-testsuite under perf like so:

sudo perf record -e avc:selinux_audited -g make test

and then ran:

sudo perf report -g

and a snippet of sample output included:

     6.40%     6.40%  requested=0x800000 denied=0x800000 
audited=0x800000 result=-13 ssid=922 tsid=922 
scontext=unconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023 
tcontext=unconfined_u:unconfined_r:test_binder_mgr_t:s0-s0:c0.c1023 
tclass=capability
            |
            ---0x495641000028933d
               __libc_start_main
               |
               |--4.60%--__GI___ioctl
               |          entry_SYSCALL_64
               |          do_syscall_64
               |          __x64_sys_ioctl
               |          ksys_ioctl
               |          binder_ioctl
               |          binder_set_nice
               |          can_nice
               |          capable
               |          security_capable
               |          cred_has_capability.isra.0
               |          slow_avc_audit
               |          common_lsm_audit
               |          avc_audit_post_callback
               |          avc_audit_post_callback
               |