Messages in this thread | | | Date | Fri, 28 Sep 2018 18:40:17 +0100 | From | Mark Rutland <> | Subject | Re: [RFC 0/5] perf: Per PMU access controls (paranoid setting) |
| |
On Fri, Sep 28, 2018 at 10:23:40AM -0700, Andi Kleen wrote: > > There's also been prior discussion on these feature in other contexts > > (e.g. android expoits resulting from out-of-tree drivers). It would be > > nice to see those considered. > > > > IIRC The conclusion from prior discussions (e.g. [1]) was that we wanted > > finer granularity of control such that we could limit PMU access to > > specific users -- e.g. disallow arbitrary android apps from poking *any* > > PMU, while allowing some more trusted apps/users to uses *some* specific > > PMUs. > > > > e.g. we could add /sys/bus/event_source/devices/${PMU}/device, protect > > this via the usual fs ACLs, and pass the fd to perf_event_open() > > somehow. A valid fd would act as a capability, taking precedence over > > perf_event_paranoid. > > That sounds like an orthogonal feature. I don't think the original > patchkit would need to be hold up for this. It would be something > in addition.
I have to say that I disagree -- these controls will have to interact somehow, and the fewer of them we have, the less complexity we'll have to deal with longer-term.
> BTW can't you already do that with the syscall filter? I assume > the Android sandboxes already use that. Just forbid perf_event_open > for the apps.
Note that this was about providing access to *some* PMUs in some cases.
IIUC, if that can be done today via a syscall filter, the same is true of per-pmu paranoid settings.
Thanks, Mark.
| |