Tracing: The Bane of You Security Folks
summary
Tracing deliberately exposes kernel internals and therefore clashes with hardening: ftrace uses a ftrace trampoline to redirect calls, live kernel patching hijacks that trampoline to change instruction pointers, and text modification uses text-poke page-table remapping to make read-only code writable temporarily. A tested laptop shows 50,377 traceable functions. Kprobes, jump labels, static keys and eBPF add alternative modification paths. A one-callback direct-ftrace registration plus a small trampoline prototype is implemented and works (still buggy), and patches add a permanent flag to prevent disabling tracing.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:55What is your goal
- 3:49Isolation
- 5:40Lockdown
- 7:34Conflicting agendas
- 8:59Security folks must know tracing
- 10:18Live kernel patching
- 17:21Function Tracing
- 21:17Peters
- 22:56FTrace
- 27:38FTrace Direct
- 30:45Conclusion
- 31:26Questions
