Messages in this thread | | | Date | Tue, 5 Jun 2012 19:41:33 -0400 | From | "Frank Ch. Eigler" <> | Subject | Re: [PATCH -tip v2 3/9] ftrace/x86: Support SAVE_REGS feature on i386 |
| |
Hi -
> > That would be the way for a kprobe to modify variables/values that > > happen to be in the registers. In systemtap, for example: > > # stap -g -e 'probe kernel.function("foo") { $bar = 1 }' > > And why would we want to allow this? > Modifying variables with probes is another way to lead to disaster. [...] > What real world example leads to external sources modifying internal > core variables? With the obvious exception of rootkits.
Among others, systemtap has been successfully used for fault injection for development/testing, as well as band-aids for kernel security vulnerabilities, where a small change of state can improve the state of the system. Obviously, this functionality is restricted to highly privileged users.
- FChE
| |