linux-kernel - Re: [PATCH] perf/tools: fix perf_evsel_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 25 Mar 2020 12:08:57 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Stephane Eranian <eranian@...gle.com>
Cc:     linux-kernel@...r.kernel.org, peterz@...radead.org, mingo@...e.hu,
        acme@...hat.com, irogers@...gle.com
Subject: Re: [PATCH] perf/tools: fix perf_evsel__fallback() for paranoid=2
 and -b

On Tue, Mar 24, 2020 at 11:10:20AM -0700, Stephane Eranian wrote:
> When perf_event_paranoid=2, regular users are prevented from sampling
> at the kernel level. However, it the user passes an event without
> a privilege level, the tool will force :u when it detects paranoid>1.
> This works well, except when branch sampling is requested. It has a more
> stringent requirement especially with exclude_hv.
> $ perf record ls
> [ perf record: Woken up 1 times to write data ]
> [ perf record: Captured and wrote 0.001 MB /tmp/perf.data ]
> 
> But:
> $ perf record -b ls
> Error:
> You may not have permission to collect stats.
> 
> Consider tweaking /proc/sys/kernel/perf_event_paranoid,
> which controls use of the performance events system by
> unprivileged users (without CAP_SYS_ADMIN).
> 
> The current value is 2:
> 
>       -1: Allow use of (almost) all events by all users
>     >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK
>     >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN
>     >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN
> 
> To make this setting permanent, edit /etc/sysctl.conf too, e.g.:
> 
>     kernel.perf_event_paranoid = -1
> 
> The problem is that in the fallback cod only exclude_kernel is checked and
> if set, then exclude_hv is not forced to 1. When branch sampling is enabled
> exclude_hv must be set.
> 
> This patch fixes the bug in the fallback code by considering the value of
> exclude_hv and not just exclude_kernel. We prefer this approach to give a
> chance to exclude_hv=0.
> 
> Signed-off-by: Stephane Eranian <eranian@...gle.com>

Acked-by: Jiri Olsa <jolsa@...hat.com>

thanks,
jirka

> ---
>  tools/perf/util/evsel.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
> index 816d930d774e7..db0e6112992e5 100644
> --- a/tools/perf/util/evsel.c
> +++ b/tools/perf/util/evsel.c
> @@ -2424,7 +2424,8 @@ bool perf_evsel__fallback(struct evsel *evsel, int err,
>  
>  		zfree(&evsel->name);
>  		return true;
> -	} else if (err == EACCES && !evsel->core.attr.exclude_kernel &&
> +	} else if (err == EACCES &&
> +		   (!evsel->core.attr.exclude_kernel || !evsel->core.attr.exclude_hv) &&
>  		   (paranoid = perf_event_paranoid()) > 1) {
>  		const char *name = perf_evsel__name(evsel);
>  		char *new_name;
> -- 
> 2.25.1.696.g5e7596f4ac-goog
>