Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752940AbbFZV0k (ORCPT ); Fri, 26 Jun 2015 17:26:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:56731 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752127AbbFZV0e (ORCPT ); Fri, 26 Jun 2015 17:26:34 -0400 Message-ID: <558DC388.5070602@redhat.com> Date: Fri, 26 Jun 2015 17:26:32 -0400 From: Prarit Bhargava User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20131028 Thunderbird/17.0.10 MIME-Version: 1.0 To: Brian Gerst CC: Linux Kernel Mailing List , "H. Peter Anvin" , Thomas Gleixner , Ingo Molnar , the arch/x86 maintainers , Len Brown , Dasaratharaman Chandramouli Subject: Re: [PATCH] x86, msr: Allow read access to /dev/cpu/X/msr References: <1435341131-3279-1-git-send-email-prarit@redhat.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1587 Lines: 41 On 06/26/2015 03:23 PM, Brian Gerst wrote: > On Fri, Jun 26, 2015 at 1:52 PM, Prarit Bhargava wrote: >> Customers write system monitoring software for single systems as well as >> clusters. In load-balancing software it is useful to know how "busy" a >> core is. Unfortunately the only way to get this data is to run as root, >> or use setcap to allow userspace access for particular programs. Both of >> these options are clunky at best. >> >> This patch allows read access to the msr dev files which should be okay. >> No damage can be done by reading the MSR values and it allows non-root >> users to run system monitoring software. >> >> The turbostat code specifically checks for CAP_SYS_RAWIO, which it >> shouldn't have to and I've removed that code. Additionally I've modified >> the turbostat man page to remove documentation about configuring >> CAP_SYS_RAW_IO. >> >> Note: Write access to msr is still restricted with this patch. > > Allowing unrestricted read access to all MSRs is wrong. Some MSRs > contain addresses of kernel data structures, which can be used in > security exploits. > > The proper way to do this is to write a driver to only expose the MSRs > that the user tools need, and nothing else. Will do -- At least I got everyone's attention with this :). P. > > -- > Brian Gerst > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/