Re: Accessing probe info synchronously

[Lasse Bigum <zenith at zenith dot dk>]

On 09:34, Thu 08 Feb, Frank Ch. Eigler wrote:
> > [...]
> > Yes, we are aware of the constraints on the runtime of each probe, and
> > also of the constraint on the sizes of arrays.
> > 
> > We initially thought about implementing the entire IDS by the way of a
> > SystemTap script, but after learning of these constraints, it seemed
> > like a bad idea.
> 
> Both the run time limits and array sizes are deliberately configurable
> quantities.  What one doesn't get to hack around is the atomicity
> requirement for kprobes-based probe handlers.

We know that the limits can be configured, but I think I must have
missed the atomicity requirement. Could you be so helpful to throw me a
link?

> > [...]  So I guess my initial question still stands: Is it possible
> > to get notified by SystemTap/use SystemTap as library, when a probe
> > is fired? [...]
> 
> Well, how would you like to receive that notification?  Given that
> typical systemtap probes can't *wait* for your application to receive
> a message and respond, what would you have in mind?

We don't want SystemTap to wait for our application, all that SystemTap
needs to do for us is to send a SIGSTOP to the application trying to
make a system call, and then notify (in some way) our IDS, and then
resume operation. Then our IDS has all the time in the world to do what
it needs to do.

As to how we notify the IDS of the system call, the application that
tried to do it, and what parameters was used for the system call, well
that is what is missing from our puzzle now I think :)

Thanks for your help so far, hope you or someone else can give us some
suggestions on how to do this.

/Lasse

Attachment: smime.p7s
Description: S/MIME cryptographic signature