linux-kernel - Re: [tip:perf/urgent] perf symbols: Handle /proc/sys/kernel/kptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 27 May 2011 10:35:54 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Arnaldo Carvalho de Melo <acme@...hat.com>
Cc:	linux-kernel@...r.kernel.org, paulus@...ba.org, hpa@...or.com,
	mingo@...hat.com, eranian@...gle.com, tzanussi@...il.com,
	penberg@...helsinki.fi, torvalds@...ux-foundation.org,
	efault@....de, peterz@...radead.org, davej@...hat.com,
	davem@...emloft.net, fweisbec@...il.com, kees.cook@...onical.com,
	tglx@...utronix.de, linux-tip-commits@...r.kernel.org
Subject: Re: [tip:perf/urgent] perf symbols: Handle
 /proc/sys/kernel/kptr_restrict


* Arnaldo Carvalho de Melo <acme@...hat.com> wrote:

> Em Thu, May 26, 2011 at 09:39:46PM +0200, Ingo Molnar escreveu:
> > Secondly, even though i have the proper 'vmlinux' in cwd, i get half 
> > a page long warnings on perf record warning me about the vmlinux:
> > 
> >   WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted, check /proc/sys/kernel/kptr_restrict.
> > 
> >   Samples in kernel functions may not be resolved if a suitable 
> >   vmlinux file is not found in the buildid cache or in the vmlinux 
> >   path.
> > 
> >   ...
> > 
> > But a vmlinux file *is* in the cwd.
> 
> Well, there was no assumption that 'perf report' would run on the same
> directory as 'perf record', the user may have moved to a different
> directory or transferred the perf.data file to a different machine.
> 
> Also it would have to check that the vmlinux on the path is suitable
> (that build-id matches), currently it does that just at 'perf report'
> time, that is when it will need to use it. At record time we just
> collect the build-ids.
> 
> With that in mind, how do you think it should be phrased?

I think the biggest problem is that it is yelling at us even when i'm 
root - and root can access all the pointer values just fine:

 # id
 uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

 # perf report --stdio
 No kallsyms or vmlinux with build-id 122214021a666675f6e5ff97d70a85ce7139c0e7 was found
 [kernel.kallsyms] with build id 122214021a666675f6e5ff97d70a85ce7139c0e7 not found, continuing without s
 Kernel address maps (/proc/{kallsyms,modules}) were restricted, check /proc/sys/kernel/kptr_restrict bef

 # tail -1 /proc/kallsyms 
 ffffffffff600d00 D __vvar_vsyscall_gtod_data

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/