Received: by 2002:a25:8b12:0:0:0:0:0 with SMTP id i18csp3545380ybl; Mon, 12 Aug 2019 02:14:55 -0700 (PDT) X-Google-Smtp-Source: APXvYqzlOcigYP00cGWpkkHRKgccqJm2KLB4KPhJ4/S7iM5c+Sjh+RNqO5MdnLRKzW9jns56hfIc X-Received: by 2002:a17:902:e282:: with SMTP id cf2mr32331838plb.301.1565601295166; Mon, 12 Aug 2019 02:14:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1565601295; cv=none; d=google.com; s=arc-20160816; b=DsEVly5BbLuhcCt/YgPCKFefm4ZCZijszw2id4oAgDHdm8IgWK3Ja440dKHe45Fpfg s5q4qf44lOmtmrgP+GHmSQJzUMl6IIfhYBb8r/CbnL2FAn7kADXODjHvrgwPUGUgPM8F bQmKw1QJDUm2OJUUTNqfHs0EaAEq4ZC1CTU+DzhR/Hm8E5QiEKsIUxm355EXk4JmVTli O7qhDuIAmxKNKK5jQ/ZoHiLAd1H7qarBmvopNscaCdwuBYOa0KKS6Pm67U0XrpYGUHHa /glAgz9w+DIXYKeKHWCHpH1HtNgd75NeGTXRqfhpHNUCPpQKTMbyS7HJ5pzDw95tYkzp gx7w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date; bh=2QLOugKExo5mC3hQcPhrheB/SQOCxkwKpGA8NWY0xM4=; b=myBXTAwJieVlYJqGPlZb6Fwr6mB+6Q0oa+FKB1GpGBO+F0FoiKmaHwByrmKK9XPtpd nPaozuZLy6KO9NWdzBX8xnryqSqzE4d8mbdiRqI/Pg3PfLYrOHEMbkt3cqDZ/q7G/ybG 9cpeOyXHKaf8zpdlNx0DmajcLAZTxcSIcA93q09S5UMxolOMTfgGJvq/Xf+h+llLwpeR WQlNgEFBeN3RMnRHewrqklkLoc5coyLGwPv42gaZnHePPP6/oVppN5GfHzlfkJWpP2j3 jQu55DN//Jdh7AvYmVcDPa9VeSjidifKn4cNrM2aUtJVlhvaFJTxGxOi173AD2KP0zd6 ISDg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d3si62459585pfr.161.2019.08.12.02.14.40; Mon, 12 Aug 2019 02:14:55 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727270AbfHLJNw (ORCPT + 99 others); Mon, 12 Aug 2019 05:13:52 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33902 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727154AbfHLJNv (ORCPT ); Mon, 12 Aug 2019 05:13:51 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4FB5030BCB86; Mon, 12 Aug 2019 09:13:51 +0000 (UTC) Received: from krava (unknown [10.43.17.33]) by smtp.corp.redhat.com (Postfix) with SMTP id D192F19C65; Mon, 12 Aug 2019 09:13:48 +0000 (UTC) Date: Mon, 12 Aug 2019 11:13:48 +0200 From: Jiri Olsa To: Igor Lubashev Cc: linux-kernel@vger.kernel.org, Arnaldo Carvalho de Melo , Alexey Budankov , Peter Zijlstra , Ingo Molnar , Mathieu Poirier , Alexander Shishkin , Namhyung Kim , Suzuki K Poulose , linux-arm-kernel@lists.infradead.org, James Morris Subject: Re: [PATCH v3 0/4] perf: Use capabilities instead of uid and euid Message-ID: <20190812091348.GA11946@krava> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Mon, 12 Aug 2019 09:13:51 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Aug 07, 2019 at 10:44:13AM -0400, Igor Lubashev wrote: > Series v1: https://lkml.kernel.org/lkml/1562112605-6235-1-git-send-email-ilubashe@akamai.com > > > Kernel is using capabilities instead of uid and euid to restrict access to > kernel pointers and tracing facilities. This patch series updates the perf to > better match the security model used by the kernel. > > This series enables instructions in Documentation/admin-guide/perf-security.rst > to actually work, even when kernel.perf_event_paranoid=2 and > kernel.kptr_restrict=1. > > The series consists of four patches: > > 01: perf: Add capability-related utilities > Add utility functions to check capabilities and perf_event_paranoid checks, > if libcap-dev[el] is available. (Otherwise, assume no capabilities.) > > 02: perf: Use CAP_SYS_ADMIN with perf_event_paranoid checks > Replace the use of euid==0 with a check for CAP_SYS_ADMIN whenever > perf_event_paranoid level is verified. > > 03: perf: Use CAP_SYSLOG with kptr_restrict checks > Replace the use of uid and euid with a check for CAP_SYSLOG when > kptr_restrict is verified (similar to kernel/kallsyms.c and lib/vsprintf.c). > Consult perf_event_paranoid when kptr_restrict==0 (see kernel/kallsyms.c). > > 04: perf: Use CAP_SYS_ADMIN instead of euid==0 with ftrace > Replace the use of euid==0 with a check for CAP_SYS_ADMIN before mounting > debugfs for ftrace. > > I tested this by following Documentation/admin-guide/perf-security.rst > guidelines and setting sysctls: > > kernel.perf_event_paranoid=2 > kernel.kptr_restrict=1 > > As an unprivileged user who is in perf_users group (setup via instructions > above), I executed: > perf record -a -- sleep 1 > > Without the patch, perf record did not capture any kernel functions. > With the patch, perf included all kernel functions. > > > Changelog: > v3: * Fix arm64 compilation (thanks, Alexey and Jiri) Acked-by: Jiri Olsa thanks, jirka > v2: * Added a build feature check for libcap-dev[el] as suggested by Arnaldo > > > Igor Lubashev (4): > perf: Add capability-related utilities > perf: Use CAP_SYS_ADMIN with perf_event_paranoid checks > perf: Use CAP_SYSLOG with kptr_restrict checks > perf: Use CAP_SYS_ADMIN instead of euid==0 with ftrace > > tools/build/Makefile.feature | 2 ++ > tools/build/feature/Makefile | 4 ++++ > tools/build/feature/test-libcap.c | 20 ++++++++++++++++++++ > tools/perf/Makefile.config | 11 +++++++++++ > tools/perf/Makefile.perf | 2 ++ > tools/perf/arch/arm/util/cs-etm.c | 3 ++- > tools/perf/arch/arm64/util/arm-spe.c | 3 ++- > tools/perf/arch/x86/util/intel-bts.c | 3 ++- > tools/perf/arch/x86/util/intel-pt.c | 2 +- > tools/perf/builtin-ftrace.c | 4 +++- > tools/perf/util/Build | 2 ++ > tools/perf/util/cap.c | 29 +++++++++++++++++++++++++++++ > tools/perf/util/cap.h | 24 ++++++++++++++++++++++++ > tools/perf/util/event.h | 1 + > tools/perf/util/evsel.c | 2 +- > tools/perf/util/python-ext-sources | 1 + > tools/perf/util/symbol.c | 15 +++++++++++---- > tools/perf/util/util.c | 9 +++++++++ > 18 files changed, 127 insertions(+), 10 deletions(-) > create mode 100644 tools/build/feature/test-libcap.c > create mode 100644 tools/perf/util/cap.c > create mode 100644 tools/perf/util/cap.h > > -- > 2.7.4 >