linux-kernel - Re: [PATCH v8 1/6] perf: Add PERF_RECORD_NAMESPACES to include namespaces related info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Mar 2017 16:52:38 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Hari Bathini <hbathini@...ux.vnet.ibm.com>
Cc:     ast@...com, peterz@...radead.org,
        lkml <linux-kernel@...r.kernel.org>,
        alexander.shishkin@...ux.intel.com, Ingo Molnar <mingo@...nel.org>,
        daniel@...earbox.net, rostedt@...dmis.org,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        ebiederm@...ssion.com, sargun@...gun.me,
        Aravinda Prasad <aravinda@...ux.vnet.ibm.com>,
        brendan.d.gregg@...il.com, jolsa@...hat.com
Subject: Re: [PATCH v8 1/6] perf: Add PERF_RECORD_NAMESPACES to include
 namespaces related info

Em Wed, Mar 08, 2017 at 02:11:36AM +0530, Hari Bathini escreveu:
> @@ -9691,6 +9825,11 @@ SYSCALL_DEFINE5(perf_event_open,
>  			return -EACCES;
>  	}
>  
> +	if (attr.namespaces) {
> +		if (!capable(CAP_SYS_ADMIN))
> +			return -EACCES;
> +	}
> +

So, testing the first tooling patch I get:

[acme@...et linux]$ perf record --namespaces ls
Error:
You may not have permission to collect stats.

Consider tweaking /proc/sys/kernel/perf_event_paranoid,
which controls use of the performance events system by
unprivileged users (without CAP_SYS_ADMIN).

The current value is 2:

  -1: Allow use of (almost) all events by all users
>= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK
>= 1: Disallow CPU event access by users without CAP_SYS_ADMIN
>= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN

To make this setting permanent, edit /etc/sysctl.conf too, e.g.:

	kernel.perf_event_paranoid = -1

[acme@...et linux]$

----------------------- 8< ---------------------------------------

So this specific case is not related to perf_event_paranoid, we need to
improve error handling here, i.e. see attr.namespaces, !CAP_SYS_ADMIN,
-EACCESS at sys_perf_event_open() -> better error message.

And perhaps we make an extra check about perf_event_paranoid... Ingo? Peter?

Can be done as a follow up patch tho, just adding entry to the collective TODO
list.

- Arnaldo