lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 17 Feb 2020 11:13:39 +0300 From: Alexey Budankov <alexey.budankov@...ux.intel.com> To: James Morris <jmorris@...ei.org>, Serge Hallyn <serge@...lyn.com>, Stephen Smalley <sds@...ho.nsa.gov>, Peter Zijlstra <peterz@...radead.org>, Arnaldo Carvalho de Melo <acme@...nel.org>, Ingo Molnar <mingo@...nel.org>, "joonas.lahtinen@...ux.intel.com" <joonas.lahtinen@...ux.intel.com>, Alexei Starovoitov <ast@...nel.org>, Will Deacon <will@...nel.org>, Paul Mackerras <paulus@...ba.org>, Helge Deller <deller@....de>, Thomas Gleixner <tglx@...utronix.de> Cc: Andi Kleen <ak@...ux.intel.com>, Stephane Eranian <eranian@...gle.com>, Igor Lubashev <ilubashe@...mai.com>, Jiri Olsa <jolsa@...hat.com>, linux-kernel <linux-kernel@...r.kernel.org>, "intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>, "linux-security-module@...r.kernel.org" <linux-security-module@...r.kernel.org>, "selinux@...r.kernel.org" <selinux@...r.kernel.org>, linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>, "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>, "linux-parisc@...r.kernel.org" <linux-parisc@...r.kernel.org>, oprofile-list@...ts.sf.net, "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>, linux-man@...r.kernel.org Subject: [PATCH v7 12/12] doc/admin-guide: update kernel.rst with CAP_PERFMON information Update kernel.rst documentation file with the information related to usage of CAP_PERFMON capability to secure performance monitoring and observability operations in system. Signed-off-by: Alexey Budankov <alexey.budankov@...ux.intel.com> --- Documentation/admin-guide/sysctl/kernel.rst | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index def074807cee..b06ae9389809 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -720,20 +720,26 @@ perf_event_paranoid: ==================== Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 2. +users (without CAP_PERFMON). The default value is 2. + +For backward compatibility reasons access to system performance +monitoring and observability remains open for CAP_SYS_ADMIN +privileged processes but CAP_SYS_ADMIN usage for secure system +performance monitoring and observability operations is discouraged +with respect to CAP_PERFMON use cases. === ================================================================== -1 Allow use of (almost) all events by all users Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK ->=0 Disallow ftrace function tracepoint by users without CAP_SYS_ADMIN +>=0 Disallow ftrace function tracepoint by users without CAP_PERFMON - Disallow raw tracepoint access by users without CAP_SYS_ADMIN + Disallow raw tracepoint access by users without CAP_PERFMON ->=1 Disallow CPU event access by users without CAP_SYS_ADMIN +>=1 Disallow CPU event access by users without CAP_PERFMON ->=2 Disallow kernel profiling by users without CAP_SYS_ADMIN +>=2 Disallow kernel profiling by users without CAP_PERFMON === ================================================================== -- 2.20.1
Powered by blists - more mailing lists