Bug 3343

Summary: perf script: install audit-libs-python to get syscall name for syscall-displaying scripts
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Tom Zanussi <tom.zanussi>
Component: kernelAssignee: Anuj Mittal <anuj.mittal>
Status: RESOLVED FIXED QA Contact:
Severity: enhancement    
Priority: Low CC: benjamin.esquivel, bruce.ashfield, chin.kooi.khor, dvhart, leonardo.sandoval.gonzalez, mark.hatle, randy.macleod, sgw, tim.orling, tom.zanussi
Version: 1.4   
Target Milestone: 2.5   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: No (bug/feature does not impact docs)
Bug Depends on:    
Bug Blocks: 3358    

Description Tom Zanussi 2012-10-26 22:49:42 UTC
Running the perf sctop script displays syscalls as raw numbers - it would be really helpful to see these as syscall names instead.  The message even tells us what to do to get them:

root@crownbay:~# perf script sctop
# ========
# captured on: Tue Feb  6 06:45:50 2018
# ========
#
Install the audit-libs-python package to get syscall names

syscall events:

event                                          count
----------------------------------------  ----------
3                                              12162
5                                               2138
6                                               1980
240                                             1150
4                                                573
197                                              116
195                                              115
220                                               82
45                                                75
192                                               66
174                                               66
91                                                40
295                                               39
13                                                32
142                                               19
196                                               15
140                                               11
54                                                 7
85                                                 6
265                                                5
181                                                5
180                                                5
221                                                4
19                                                 3
168                                                2
125                                                2
311                                                1
268                                                1
202                                                1
201                                                1
200                                                1
Comment 1 Aníbal Limón 2016-12-13 20:05:00 UTC
Hi Tom,

I started to review this bug and found your thread to add perf live mode [1].

After try to use:

$ pref trace sctop

and

$ perf sctop script d

It didn't work on master, may be the issue is now invalid since has loaded some years ago.

Could you provide me an input?

Thanks in advance,
alimon

[1] https://lwn.net/Articles/381634/
Comment 2 Leonardo Sandoval Gonzalez 2016-12-13 20:14:53 UTC
Changing the state to needinfo, because Anibal wants some input from Tom before moving on.
Comment 3 Saul Wold 2017-02-11 00:19:28 UTC
this issue is still valid, I just verified it with 2.3 master

You need to install both perf and perf-python and that will provide the sctop script.  As pointed out by Tom's initial entry we then need the python bindings for libaudit and libauparse, a quick search in meta-python and layers.openembedded.org did not show those libraries.

They are available here: http://people.redhat.com/sgrubb/audit/

Tim (added to Cc) might also know if they are available someplace.
Comment 4 Tim Orling 2017-02-11 05:47:03 UTC
Do we need to add these to OE-core?
Comment 5 Tim Orling 2017-02-11 06:20:37 UTC
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/tree/recipes-security/audit/audit_2.7.bb

However, latest upstream version is 2.7.1

I am working on the upgrade recipe, but need to know if we want to add it to core. My gut feeling is yes.
Comment 6 Tim Orling 2017-02-11 06:25:17 UTC
Add meta-selinux maintainer (fray) to CC
Comment 7 Saul Wold 2017-02-14 17:26:04 UTC
Tim, I think yes, we might want to add the audit info as it will help work with the perf which is part of OE-Core already.
Comment 8 Mark Hatle 2017-02-24 18:13:40 UTC
I'm looking at the audit 2.7.1 recipe.

It has the following:

        --with-libwrap \
        --with-libcap-ng=yes \
        --with-python=yes \
        --without-python3 \

Does anyone know if we should be building (optionally [pkgconfig] or otherwise) the python3 components for this work?

Once the component is configured correctly, then I can help get this back to oe-core if the work is in an acceptable condition.
Comment 9 Saul Wold 2017-03-20 17:43:49 UTC
I think since we do support python3 now it should probably be optionally included via PACKAGECONFIG.

This change is probably to late for 2.3, do I am going to move it to 2.4

This is possibly related to fixing Bug 3358 also, so I am going to mark it as blocks that one
Comment 10 Anuj Mittal 2018-01-26 07:21:51 UTC
I checked that this works with python3 and the syscall names also start coming up as expected after audit, audit-python is installed.

Tim, can you still help please move this recipe to OE-core? I am not very sure why --without-python3 is still there ...
Comment 11 Tim Orling 2018-01-26 16:30:37 UTC
meta-selinux has updated to 2.7.6:
http://git.yoctoproject.org/cgit/cgit.cgi/meta-selinux/log/recipes-security/audit/audit_2.7.6.bb

I'll try to take a look at the PKGCONFIG in the coming days, but it all depends on fray's buy off on the resulting recipe.
Comment 12 Tim Orling 2018-01-26 16:33:06 UTC
Please note that upstream version is 2.8.2:
"The latest is 2.8.2, released Dec 14, 2017."
http://people.redhat.com/sgrubb/audit/index.html