Skip to content

Add QQ_TTY outside of QQ_BYPASS.#263

Merged
haesbaert merged 1 commit intomainfrom
qqtty
Nov 3, 2025
Merged

Add QQ_TTY outside of QQ_BYPASS.#263
haesbaert merged 1 commit intomainfrom
qqtty

Conversation

@haesbaert
Copy link
Copy Markdown
Collaborator

@haesbaert haesbaert commented Nov 3, 2025

This forwards tty writes as a quark event, some notes:

We should do our own tty aggregation, possibly also aggregating within a fork+exec.

sudo traps the output of the child process and then forwards to the actual stdout, this means that under sudo the process that does the tty write is the parent of the actual process doing the write. This makes it difficult to filter our own output, meaning the first time we print something we get stuck in a self feeding loop.

In the future we can add some logic to detect we are running under sudo, by checking the environment or maybe going up the tree and seeing if we are the child of a sudo process.

Because of the sudo complication, I haven't added it to quark-mon(8) and/or quark_event_dump(), but there's a test.

We don't get events for tty_writes when running on initramfs, so detect it and
escape. It's likely that we don't have a pty and our code doesn't consider an
actual tty? Needs more investigation.

Issue #261

Copy link
Copy Markdown
Contributor

@nicholasberlin nicholasberlin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread bpf_queue.c Outdated
* add one anyway for users that screw up.
*/
alloc_len = sizeof(*qtty) + data_len + 1; /* extra for NUL */
if ((qtty = calloc(1, alloc_len)) == NULL)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we're overwriting all the data ... malloc is probably a little faster.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good point, I'll change

This forwards tty writes as a quark event, some notes:

We should do our own tty aggregation, possibly also aggregating within a
fork+exec.

sudo traps the output of the child process and then forwards to the actual
stdout, this means that under sudo the process that does the tty write is the
parent of the actual process doing the write. This makes it difficult to filter
our own output, meaning the first time we print something we get stuck in a self
feeding loop.

In the future we can add some logic to detect we are running under
sudo, by checking the environment or maybe going up the tree and seeing if we
are the child of a sudo process.

Because of the sudo complication, I haven't added it to quark-mon(8) and/or
quark_event_dump(), but there's a test.

We don't get events for tty_writes when running on initramfs, so detect it and
escape. It's likely that we don't have a pty and our code doesn't consider an
actual tty? Needs more investigation.
@haesbaert haesbaert merged commit c2e3530 into main Nov 3, 2025
2 checks passed
haesbaert added a commit that referenced this pull request Nov 4, 2025
If you want btfhub you now have to build with WITH_BTFHUB=y.
This cuts quark-mon from 7MB to 3MB and libquark_big.a from 13MB to 7MB.

It's a bit clunky as we have to pass the option down to the container builds,
but it works.
haesbaert added a commit that referenced this pull request Nov 4, 2025
If you want btfhub you now have to build with WITH_BTFHUB=y.
This cuts quark-mon from 7MB to 3MB and libquark_big.a from 13MB to 7MB.

It's a bit clunky as we have to pass the option down to the container builds,
but it works.
haesbaert added a commit that referenced this pull request Nov 4, 2025
If you want btfhub you now have to build with WITH_BTFHUB=y.
This cuts quark-mon from 7MB to 3MB and libquark_big.a from 13MB to 7MB.

It's a bit clunky as we have to pass the option down to the container builds,
but it works.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants