fche changed the topic of #systemtap to: http://sourceware.org/systemtap; email systemtap@sourceware.org if answers here not timely, conversations may be logged
orivej has quit [Ping timeout: 255 seconds]
hpt has joined #systemtap
Amy1 has joined #systemtap
khaled has joined #systemtap
khaled has quit [Quit: Konversation terminated!]
khaled has joined #systemtap
slowfranklin has joined #systemtap
mjw has joined #systemtap
orivej has joined #systemtap
yog_ has joined #systemtap
hpt has quit [Ping timeout: 268 seconds]
sscox has quit [Ping timeout: 252 seconds]
khaled has quit [Remote host closed the connection]
khaled has joined #systemtap
khaled has quit [Remote host closed the connection]
slowfranklin has quit [Quit: slowfranklin]
yog_ has quit [Ping timeout: 250 seconds]
slowfranklin has joined #systemtap
orivej has quit [Ping timeout: 255 seconds]
wcohen has quit [Ping timeout: 255 seconds]
yog_ has joined #systemtap
sscox has joined #systemtap
wcohen has joined #systemtap
LeoB has joined #systemtap
LeoB has quit [Changing host]
LeoB has joined #systemtap
khaled has joined #systemtap
LeoB has quit [Remote host closed the connection]
khaled has quit [Remote host closed the connection]
khaled has joined #systemtap
khaled has quit [Remote host closed the connection]
khaled has joined #systemtap
yog_ has quit [Ping timeout: 250 seconds]
yog_ has joined #systemtap
orivej has joined #systemtap
khaled has quit [Quit: Konversation terminated!]
khaled has joined #systemtap
changcheng has joined #systemtap
<changcheng> I'm using systemstap on ubuntu 18.04.1, the kernel is 4.18.0-15-generic
<changcheng> I hit below problem on the system:
<changcheng> [ 67.133574] mod1: loading out-of-tree module taints kernel.
<changcheng> [ 67.135012] Lockdown: staprun: debugfs is restricted; see man kernel_lockdown.7
<changcheng> Does anyone know how to solve it?
<changcheng> mod1.ko is generated by:
<changcheng> 1) stap -p4 -m mod1 -e 'global var1="foo"; probe begin{printf("%s\n", var1); exit()}'
<changcheng> 2) sign mod1.ko with self generated key
<fche> changcheng, https://bugzilla.redhat.com/show_bug.cgi?id=1638874 <-- see also this
<fche> setenv SYSTEMTAP_SIGN=1
<fche> that way stap will treat the machine like the secureboot-type configuration it is, and can arrange to use a compilation server to build & sign modules via a MOK key
<fche> that patch (commit b371843bc) went into stap 4.0
<changcheng> @fche: My system use UEFI Secure boot mode
<changcheng> I generated the key and imported into MOK key list.
<changcheng> Then I use stap -p4 to generate the module and sign the moduel with the private key.
<fche> yes, you can do it by hand
<fche> but stap can automate this for you
<changcheng> The compilation server and client is same for me (I use my own machine to build the driver and install the ko. The ubuntu is the offical relaese)
<changcheng> Is there any guide how to setup the server and what's scripts could be used to sign with key automatically?
<fche> the only extra bit is triggering this secureboot logic with that $SYSTEMTAP_SIGN=1 env variable
<changcheng> Currently, I've already signed the genreated driver module. So I only need do "export SYSTEMTAP_SIGN=1; stap mod1.ko", right?
<fche> if it's already signed, then you're done
<fche> this SYSTEMTAP_SIGN business is to get stap foo.stp to run through the compilation-server / signing dance for you
<changcheng> However, staprun mod1.ko still hit the problem.
<fche> hm .... if that mok key is enrolled, I thought it should not
<changcheng> strings mod1.ko | grep -i append
<changcheng> ~Module signature appended~
<changcheng> The mok key has been enrolled yet.
<changcheng> For ubuntu 18.04.1, the kernel version is 4.18.0-15
<fche> hm interesting
<fche> if you had the time, it'd be great to record your observations into sourceware.org/bugzilla
<changcheng> Thanks for your suggestion. I'll put the bug link here once being filed (I'm in UTC+8 TZ, sleep now.). Have a good day.
changcheng has quit [Quit: WeeChat 1.9.1]
changcheng has joined #systemtap
<fche> thanks a lot
<fche> what an unfortunate problem
<fche> these well-intentioned security patches and their unintended consequences
slowfranklin has left #systemtap [#systemtap]
yog_ has quit [Ping timeout: 246 seconds]
slowfranklin has joined #systemtap
mjw has quit [Quit: Leaving]
slowfranklin has quit [Quit: slowfranklin]
khaled has quit [Quit: Konversation terminated!]
wcohen has quit [Ping timeout: 264 seconds]
orivej has quit [Read error: Connection reset by peer]
orivej has joined #systemtap
sscox has quit [Ping timeout: 250 seconds]
wcohen has joined #systemtap