lkml.org 
[lkml]   [2020]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v4 2/9] perf/core: open access for CAP_SYS_PERFMON privileged process
    From
    Date

    On 01.04.2020 23:49, Alexey Budankov wrote:
    > Hi Peter,
    >
    > On 08.01.2020 19:07, Peter Zijlstra wrote:
    >> On Wed, Dec 18, 2019 at 12:25:35PM +0300, Alexey Budankov wrote:
    >>>
    >>> Open access to perf_events monitoring for CAP_SYS_PERFMON privileged
    >>> processes. For backward compatibility reasons access to perf_events
    >>> subsystem remains open for CAP_SYS_ADMIN privileged processes but
    >>> CAP_SYS_ADMIN usage for secure perf_events monitoring is discouraged
    >>> with respect to CAP_SYS_PERFMON capability.
    >>>
    >>> Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com>
    >>> ---
    >>> include/linux/perf_event.h | 6 +++---
    >>> kernel/events/core.c | 6 +++---
    >>> 2 files changed, 6 insertions(+), 6 deletions(-)
    >>>
    >>> diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
    >>> index 34c7c6910026..f46acd69425f 100644
    >>> --- a/include/linux/perf_event.h
    >>> +++ b/include/linux/perf_event.h
    >>> @@ -1285,7 +1285,7 @@ static inline int perf_is_paranoid(void)
    >>>
    >>> static inline int perf_allow_kernel(struct perf_event_attr *attr)
    >>> {
    >>> - if (sysctl_perf_event_paranoid > 1 && !capable(CAP_SYS_ADMIN))
    >>> + if (sysctl_perf_event_paranoid > 1 && !perfmon_capable())
    >>> return -EACCES;
    >>>
    >>> return security_perf_event_open(attr, PERF_SECURITY_KERNEL);
    >>> @@ -1293,7 +1293,7 @@ static inline int perf_allow_kernel(struct perf_event_attr *attr)
    >>>
    >>> static inline int perf_allow_cpu(struct perf_event_attr *attr)
    >>> {
    >>> - if (sysctl_perf_event_paranoid > 0 && !capable(CAP_SYS_ADMIN))
    >>> + if (sysctl_perf_event_paranoid > 0 && !perfmon_capable())
    >>> return -EACCES;
    >>>
    >>> return security_perf_event_open(attr, PERF_SECURITY_CPU);
    >>> @@ -1301,7 +1301,7 @@ static inline int perf_allow_cpu(struct perf_event_attr *attr)
    >>>
    >>> static inline int perf_allow_tracepoint(struct perf_event_attr *attr)
    >>> {
    >>> - if (sysctl_perf_event_paranoid > -1 && !capable(CAP_SYS_ADMIN))
    >>> + if (sysctl_perf_event_paranoid > -1 && !perfmon_capable())
    >>> return -EPERM;
    >>>
    >>> return security_perf_event_open(attr, PERF_SECURITY_TRACEPOINT);
    >>
    >> These are OK I suppose.
    >>
    >>> diff --git a/kernel/events/core.c b/kernel/events/core.c
    >>> index 059ee7116008..d9db414f2197 100644
    >>> --- a/kernel/events/core.c
    >>> +++ b/kernel/events/core.c
    >>> @@ -9056,7 +9056,7 @@ static int perf_kprobe_event_init(struct perf_event *event)
    >>> if (event->attr.type != perf_kprobe.type)
    >>> return -ENOENT;
    >>>
    >>> - if (!capable(CAP_SYS_ADMIN))
    >>> + if (!perfmon_capable())
    >>> return -EACCES;
    >>>
    >>> /*
    >>
    >> This one only allows attaching to already extant kprobes, right? It does
    >> not allow creation of kprobes.
    >>
    >>> @@ -9116,7 +9116,7 @@ static int perf_uprobe_event_init(struct perf_event *event)
    >>> if (event->attr.type != perf_uprobe.type)
    >>> return -ENOENT;
    >>>
    >>> - if (!capable(CAP_SYS_ADMIN))
    >>> + if (!perfmon_capable())
    >>> return -EACCES;
    >>>
    >>> /*
    >>
    >> Idem, I presume.
    >>
    >>> @@ -11157,7 +11157,7 @@ SYSCALL_DEFINE5(perf_event_open,
    >>> }
    >>>
    >>> if (attr.namespaces) {
    >>> - if (!capable(CAP_SYS_ADMIN))
    >>> + if (!perfmon_capable())
    >>> return -EACCES;
    >>> }
    >>
    >> And given we basically make the entire kernel observable with this CAP,
    >> busting namespaces shoulnd't be a problem either.
    >>
    >> So yeah, I suppose that works.
    >
    > Could this have you explicit Reviewed-by or Acked-by tag
    > so the changes could be driven into the kernel?
    > Latest v7 is here:
    > https://lore.kernel.org/lkml/c8de937a-0b3a-7147-f5ef-69f467e87a13@linux.intel.com/

    Posted v8 with all acquired tags so far:
    https://lore.kernel.org/lkml/f96f8f8a-e65c-3f36-dc85-fc3f5191e8c5@linux.intel.com/

    Thanks,
    Alexey

    \
     
     \ /
      Last update: 2020-04-03 16:29    [W:4.213 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site