linux-kernel - Re: [PATCH] tools/perf: doc: Add permission and sysctl notice

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210526221647.972ffffddc88c1b08c19a024@kernel.org>
Date:   Wed, 26 May 2021 22:16:47 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Ravi Bangoria <ravi.bangoria@...ux.ibm.com>
Cc:     Jiri Olsa <jolsa@...nel.org>, jolsa@...hat.com,
        linux-kernel@...r.kernel.org,
        "Aneesh Kumar K . V" <aneesh.kumar@...ux.ibm.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>, acme@...nel.org
Subject: Re: [PATCH] tools/perf: doc: Add permission and sysctl notice

On Wed, 26 May 2021 15:20:58 +0530
Ravi Bangoria <ravi.bangoria@...ux.ibm.com> wrote:

> 
> 
> On 5/26/21 2:31 PM, Masami Hiramatsu wrote:
> > Add a section to notify the permission and sysctl setting
> > for perf probe. And fix some indentations.
> 
> Yes, it makes sense to have this detail in man page.
> 
> Few minor points below ...
> 
> >   
> > +PERMISSIONS AND SYSCTL
> > +----------------------
> > +Since perf probe depends on ftrace (tracefs) and kallsyms (/proc/kallsyms), you have to care about the permission and some sysctl knobs.
> > +
> > + - Since tracefs and kallsyms requires root or privileged user to access it, the following perf probe commands also require it; --add, --del, --list (except for --cache option)
> > +
> > + - /proc/sys/kernel/kptr_restrict = 2 (restrict all users) also prevents perf probe to retrieve the important information from kallsyms. You also need to set to 1 (restrict non CAP_SYSLOG users) for the above commands.
> > +
> > + - Since the perf probe commands read the vmlinux and/or the debuginfo file, you need to ensure that you can read those files.
> 
> 1) Last two points are applicable to kprobes only, not uprobes. Would
>     it make sense to clarify that?

Ah, right. And the last one may be also related to uprobes.

> 2) For 3rd point, simple perf probe on function entry will work without
>     vmlinux/debuginfo (by using kallsyms). Should we mention that?

Hmm, that depends on the options. If we use -k option, it will get the symbols from the given vmlinux.

> 
> In any case,
> 
> Acked-by: Ravi Bangoria <ravi.bangoria@...ux.ibm.com>

Thanks! I'll update it for uprobe.


> 
> Ravi


-- 
Masami Hiramatsu <mhiramat@...nel.org>