security for systemtap compiler server

[Stone, Joshua I]

Frank Ch. Eigler wrote:
> Second, it is part of enabling unprivileged users to run systemtap
> scripts that are severely restricted (no kernel probes; only probes on
> one's own processes; that sort of thing).

We can easily classify probe points in this way, but we'll have to be
careful about which tapset functions may be called.  Perhaps we can
bless them with a new keyword, similar to how "pure" works now.

Also, printf %b may have to be disallowed, unless we can find a way to
certify the pointer origin.

> Is all this making sense so far?

The rest that you said sounds good to me...

Josh