RE: FW: Re: pre-compiled systemtap modules - try2 feature request

["David Sperry" <dave_sperry at ieee dot org>]

> -----Original Message-----
> From: fche@redhat.com [mailto:fche@redhat.com]
> Sent: Friday, September 15, 2006 4:16 PM
> To: David Sperry
> Cc: systemtap@sources.redhat.com
> Subject: Re: FW: Re: pre-compiled systemtap modules - try2 feature request
> 
> "David Sperry" <dave_sperry@ieee.org> writes:
> 
> 
> > [...] SystemTap basically works in our environment has helped us
> > isolate problems with various parts of the RT kernel. We have
> > started to grow some simple scripts that are useful to our
> > environment.
> 
> Great.
> 
> > Unfortunately our security policy limits who can have root
> > privileges to less than 0.5% of our users. What we would like to do
> > is have the majority of our user base be able to run only
> > pre-compiled modules which are blessed by our internal
> > security. [...]
> 
> We are aware of this need, and work is in progress as we speak to
> promote this style of usage.  Do you have any suggestions about what
> form the "blessings" might have?


For the next couple of years the security blessing is fairly simple. The
user cannot have root access to the file system, capture or read other users
passwords, impersonate another user, or bypass kernel auditing. 

At this point our security personnel are not hard core programmers. They
follow industry guidelines and some other sources. The security people like
SystemTapGui because they can navigate the probes and functions we are using
in our scripts and get the basic idea of what is be tapped. We can get a
systemTap script approved for use very quickly. If we have to patch the
kernel to do the same thing, it may take a week to get approved.  

-Dave

> 
> - FChE