How does embedded C + annotations + privileges really play together?

[Frank Ch. Eigler]

Petr Muller <muller@redhat.com> writes:

> Seems logical, but then there follows a description of "The embedded-C
> code may contain markers to ...", which contains stuff like '/*
> unprivileged */' and '/* guru */'. The first one says that with these
> annotations it should be possible to use embedded C even as a
> unprivileged user, and the second one seems simply redundant.

The /* guru */ markup is useful in embedded-C functions in the tapset.
Normally, embedded-C code in the tapset is allowed to be called,
without stap -g guru mode, because it is presumed to be
safely/competently written.  These are usually for direct invocation
from within the tapset handlers themselves.

Such functions may not be invoked from --privilege=stapusr mode at
all, unless they are instead marked /* unprivileged */.  These