linux-kernel - Re: [tip:perf/urgent] perf symbols: Check '/tmp/perf-' symbol file ownership

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOJsxLFhhg0GRb3rBJf7Tk+_ROYi06xmg=tMcpmDWrpwQuRTKg@mail.gmail.com>
Date:	Fri, 12 Aug 2011 20:34:55 +0300
From:	Pekka Enberg <penberg@...nel.org>
To:	David Ahern <dsahern@...il.com>
Cc:	mingo@...hat.com, hpa@...or.com, linux-kernel@...r.kernel.org,
	acme@...hat.com, fweisbec@...il.com, peterz@...radead.org,
	tglx@...utronix.de, mingo@...e.hu,
	linux-tip-commits@...r.kernel.org
Subject: Re: [tip:perf/urgent] perf symbols: Check '/tmp/perf-' symbol file ownership

On Thu, Aug 11, 2011 at 7:51 AM, David Ahern <dsahern@...il.com> wrote:
> On 08/10/2011 03:48 AM, tip-bot for Pekka Enberg wrote:
>> Commit-ID:  981c1252691f4b855f2bb47ea93fb6052ea3aee2
>> Gitweb:     http://git.kernel.org/tip/981c1252691f4b855f2bb47ea93fb6052ea3aee2
>> Author:     Pekka Enberg <penberg@...nel.org>
>> AuthorDate: Tue, 9 Aug 2011 22:54:18 +0300
>> Committer:  Arnaldo Carvalho de Melo <acme@...hat.com>
>> CommitDate: Tue, 9 Aug 2011 15:23:08 -0300
>>
>> perf symbols: Check '/tmp/perf-' symbol file ownership
>>
>> The external symbol files are generated by JIT compilers, for example, but we
>> need to make sure they're ours before injecting them to 'perf report'.
>>
>> Requested-by: Ingo Molnar <mingo@...e.hu>
>> Cc: Frederic Weisbecker <fweisbec@...il.com>
>> Cc: Peter Zijlstra <peterz@...radead.org>
>> Link: http://lkml.kernel.org/r/1312919658-17158-1-git-send-email-penberg@kernel.org
>> Signed-off-by: Pekka Enberg <penberg@...nel.org>
>> Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
>> ---
>>  tools/perf/util/symbol.c |   11 +++++++++++
>>  1 files changed, 11 insertions(+), 0 deletions(-)
>>
>> diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
>> index eec1963..a8b5371 100644
>> --- a/tools/perf/util/symbol.c
>> +++ b/tools/perf/util/symbol.c
>> @@ -1504,6 +1504,17 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
>>       dso->adjust_symbols = 0;
>>
>>       if (strncmp(dso->name, "/tmp/perf-", 10) == 0) {
>> +             struct stat st;
>> +
>> +             if (stat(dso->name, &st) < 0)
>> +                     return -1;
>> +
>> +             if (st.st_uid && (st.st_uid != geteuid())) {
>> +                     pr_warning("File %s not owned by current user or root, "
>> +                             "ignoring it.\n", dso->name);
>> +                     return -1;
>> +             }
>
> Is the force option relevant here -- similar to perf_session__open()?

I don't know, I guess not. Ingo, Arnaldo?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/