---

   stap    ( 1 )

---

UNPRIVILEGED USERS

Systemtap exposes kernel internal data structures and potentially private user information. Because of this, use of systemtap's full capabilities are restricted to root and to users who are members of the groups stapdev and stapusr.

However, a restricted set of systemtap's features can be made available to trusted, unprivileged users. These users are members of the group stapusr only, or members of the groups stapusr and stapsys. These users can load systemtap modules which have been compiled and certified by a trusted systemtap compile-server. See the descriptions of the options --privilege and --use-server. See README.unprivileged in the systemtap source code for information about setting up a trusted compile server.

The restrictions enforced when --privilege=stapsys is specified are designed to prevent unprivileged users from:

• harming the system maliciously.

The restrictions enforced when --privilege=stapusr is specified are designed to prevent unprivileged users from:

• harming the system maliciously.

• gaining access to information which would not normally be available to an unprivileged user.

• disrupting the performance of processes owned by other users of the system. Some overhead to the system in general is unavoidable since the unprivileged user's probes will be triggered at the appropriate times. What we would like to avoid is targeted interruption of another user's processes which would not normally be possible by an unprivileged user.

PROBE RESTRICTIONS A member of the groups stapusr and stapsys may use all probe points.

A member of only the group stapusr may use only the following probes:

• begin, begin(n)

• end, end(n)

• error(n)

• never

• process.*, where the target process is owned by the user.

• timer.{jiffies,s,sec,ms,msec,us,usec,ns,nsec}(n)*

• timer.hz(n)

SCRIPT LANGUAGE RESTRICTIONS The following scripting language features are unavailable to all unprivileged users:

• any feature enabled by the Guru Mode (-g) option.

• embedded C code.

RUNTIME RESTRICTIONS The following runtime restrictions are placed upon all unprivileged users:

• Only the default runtime code (see -R) may be used.

Additional restrictions are placed on members of only the group stapusr:

• Probing of processes owned by other users is not permitted.

• Access of kernel memory (read and write) is not permitted.

COMMAND LINE OPTION RESTRICTIONS Some command line options provide access to features which must not be available to all unprivileged users:

• -g may not be specified.

• The following options may not be used by the compile- server client:

-a, -B, -D, -I, -r, -R

ENVIRONMENT RESTRICTIONS The following environment variables must not be set for all unprivileged users:

SYSTEMTAP_RUNTIME SYSTEMTAP_TAPSET SYSTEMTAP_DEBUGINFO_PATH

TAPSET RESTRICTIONS In general, tapset functions are only available for members of the group stapusr when they do not gather information that an ordinary program running with that user's privileges would be denied access to.

There are two categories of unprivileged tapset functions. The first category consists of utility functions that are unconditionally available to all users; these include such things as:

cpu:long () exit () str_replace:string (prnt_str:string, srch_str:string, rplc_str:string)

The second category consists of so-called myproc-unprivileged functions that can only gather information within their own processes. Scripts that wish to use these functions must test the result of the tapset function is_myproc and only call these functions if the result is 1. The script will exit immediately if any of these functions are called by an unprivileged user within a probe within a process which is not owned by that user. Examples of myproc-unprivileged functions include:

print_usyms (stk:string) user_int:long (addr:long) usymname:string (addr:long)

A compile error is triggered when any function not in either of the above categories is used by members of only the group stapusr.

No other built-in tapset functions may be used by members of only the group stapusr.