linux-kernel - Re: [PATCH] perf probe: Provide more detail with relocation warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210525214858.33a66846ac09e499c3268a63@kernel.org>
Date:   Tue, 25 May 2021 21:48:58 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Ravi Bangoria <ravi.bangoria@...ux.ibm.com>
Cc:     acme@...nel.org, jolsa@...hat.com, mhiramat@...nel.org,
        linux-kernel@...r.kernel.org, aneesh.kumar@...ux.ibm.com
Subject: Re: [PATCH] perf probe: Provide more detail with relocation warning

On Tue, 25 May 2021 10:07:44 +0530
Ravi Bangoria <ravi.bangoria@...ux.ibm.com> wrote:

> When run as normal user with default sysctl kernel.kptr_restrict=0
> and kernel.perf_event_paranoid=2, perf probe fails with:
> 
>   $ ./perf probe move_page_tables
>   Relocated base symbol is not found!
> 
> The warning message is not much informative. The reason perf fails
> is because /proc/kallsyms is restricted by perf_event_paranoid=2
> for normal user and thus perf fails to read relocated address of
> the base symbol.
> 
> Tweaking kptr_restrict and perf_event_paranoid can change the
> behavior of perf probe. Also, running as root or privileged user
> works too. Add these details in the warning message.
> 
> Plus, kmap->ref_reloc_sym might not be always set even if
> host_machine is initialized. Above is the example of the same.
> Remove that comment.

Yes, those are restricted in some cases. Anyway without priviledged
(super) user, perf probe can not set the probe in ftrace.

Hmm, I think it should check the effective user-id at first. If it
is not super user and the action will access tracefs and kallsyms,
it should warn at that point. 

Thank you,

> 
> Reported-by: Aneesh Kumar K.V <aneesh.kumar@...ux.ibm.com>
> Signed-off-by: Ravi Bangoria <ravi.bangoria@...ux.ibm.com>
> ---
>  tools/perf/util/probe-event.c | 11 ++++++++---
>  1 file changed, 8 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
> index a78c8d59a555..3a7649835ec9 100644
> --- a/tools/perf/util/probe-event.c
> +++ b/tools/perf/util/probe-event.c
> @@ -108,7 +108,6 @@ void exit_probe_symbol_maps(void)
>  
>  static struct ref_reloc_sym *kernel_get_ref_reloc_sym(struct map **pmap)
>  {
> -	/* kmap->ref_reloc_sym should be set if host_machine is initialized */
>  	struct kmap *kmap;
>  	struct map *map = machine__kernel_map(host_machine);
>  
> @@ -819,7 +818,10 @@ post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
>  
>  	reloc_sym = kernel_get_ref_reloc_sym(&map);
>  	if (!reloc_sym) {
> -		pr_warning("Relocated base symbol is not found!\n");
> +		pr_warning("Relocated base symbol is not found! "
> +			   "Check /proc/sys/kernel/kptr_restrict\n"
> +			   "and /proc/sys/kernel/perf_event_paranoid. "
> +			   "Or run as privileged perf user.\n\n");
>  		return -EINVAL;
>  	}
>  
> @@ -3025,7 +3027,10 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev,
>  			(!pp->retprobe || kretprobe_offset_is_supported())) {
>  		reloc_sym = kernel_get_ref_reloc_sym(NULL);
>  		if (!reloc_sym) {
> -			pr_warning("Relocated base symbol is not found!\n");
> +			pr_warning("Relocated base symbol is not found! "
> +				   "Check /proc/sys/kernel/kptr_restrict\n"
> +				   "and /proc/sys/kernel/perf_event_paranoid. "
> +				   "Or run as privileged perf user.\n\n");
>  			ret = -EINVAL;
>  			goto out;
>  		}
> -- 
> 2.31.1
> 


-- 
Masami Hiramatsu <mhiramat@...nel.org>