The Realities of DTrace on FreeBSD - George Neville Neil
Channel: EuroBSDcon
Date: 2019-10-16

Description:

This presentation is based upon the work of five authors:
Jonathan Anderson, Brian Kidney, George Neville-Neil, Arun Thomas, and
Robert Watson.

For more than a year we have been using DTrace as one of the three core
components of a security research project, CADETS. Unlike earlier users
of DTrace, which were focused on occasional, deep debugging sessions,
the CADETS project uses DTrace to bring total system transparency to
both the operating system and the applications that are running on top
of it. The use of “always-on tracing” pushes the DTrace system up to,
and often, past its limits and shows how some of the original design
tradeoffs need to be revisited to address the needs of our project. Our
talk covers our current efforts to extend and improve the DTrace
framework in FreeBSD, including performance and programming improvements
to address the needs of always-on tracing as well as integration with
FreeBSD’s audit subsystem and the addition of machine-readable output
for use by creators of downstream security-analysis tools.

Speaker biography:

George Neville-Neil works on networking and operating system code for
fun and profit. He also teaches various courses on subjects related to
computer programming. His professional areas of interest include code
spelunking, operating systems, networking, time and security. He is the
co-author with Marshall Kirk McKusick and Robert Watson of The Design
and Implementation of the FreeBSD Operating System and is the columnist
behind ACM Queue’s “Kode Vicious.” Mr. Neville-Neil earned his
bachelor’s degree in computer science at Northeastern University in
Boston, Massachusetts, and is a member of the ACM, the Usenix
Association, the IEEE, and is one of the Directors of the FreeBSD
Foundation. He is an avid bicyclist and traveler who currently resides
in New York City.