Messages in this thread | | | Date | Sat, 1 Nov 2014 23:10:02 +0100 (CET) | From | Thomas Gleixner <> | Subject | Re: [PATCH v2 5/8] perf: Add pmu callbacks to track event mapping and unmapping |
| |
On Sat, 1 Nov 2014, Andy Lutomirski wrote: > On Nov 1, 2014 1:39 PM, "Thomas Gleixner" <tglx@linutronix.de> wrote: > > On Sat, 1 Nov 2014, Andy Lutomirski wrote: > > > There's plenty of room to tighten up the restrictions further, but > > > this is, I think, a decent first step, and it solves the problem of > > > information leaking into seccomp sandboxes. > > > > In which way? > > All the performance counters were readable without using any syscalls. > That leaks hints as to which events are in use, and it possibly leaks > interesting side channel information. With this series applied, you > need a at least mmap an rdpmc-able event, which most seccomp sandboxes > won't allow.
Ok. So you are preventing the seccomp sandboxes to open/mmap a counter.
> Unfortunately, rdpmc access to counters can't be controlled > individually, so it's hard to do all that much better than this.
Yeah, I know ...
Thanks,
tglx
| |