* [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1
@ 2016-09-21 3:48 Wang Nan
2016-09-21 3:55 ` Wangnan (F)
0 siblings, 1 reply; 5+ messages in thread
From: Wang Nan @ 2016-09-21 3:48 UTC (permalink / raw)
To: acme; +Cc: linux-kernel, lizefan, pi3orama, Wang Nan, Arnaldo Carvalho de Melo
Before this patch perf panic if kptr_restrict set to 1 and perf is owned
by root with suid set:
$ whoami
wangnan
$ ls -l ./perf
-rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
$ cat /proc/sys/kernel/kptr_restrict
1
$ cat /proc/sys/kernel/perf_event_paranoid
-1
$ ./perf record -a
Segmentation fault (core dumped)
The reason is perf assumes it is allowed to read kptr from /proc/kallsyms
when euid is root, but in fact kernel doesn't allow it reading kptr when
euid and uid are not match with each other:
$ cp /bin/cat .
$ sudo chown root:root ./cat
$ sudo chmod u+s ./cat
$ cat /proc/kallsyms | grep do_fork
0000000000000000 T _do_fork <--- kptr is hidden even euid is root
$ sudo cat /proc/kallsyms | grep do_fork
ffffffff81080230 T _do_fork
See lib/vsprintf.c for kernel side code.
This patch fixes this problem by checking both uid and euid.
Signed-off-by: Wang Nan <wangnan0@huawei.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/symbol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 19c9c55..9528702 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1946,8 +1946,9 @@ static bool symbol__read_kptr_restrict(void)
if (fp != NULL) {
char line[8];
+
if (fgets(line, sizeof(line), fp) != NULL)
- value = (geteuid() != 0) ?
+ value = ((geteuid() != 0) || (getuid() != 0)) ?
(atoi(line) != 0) :
(atoi(line) == 2);
--
1.8.3.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1
2016-09-21 3:48 [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1 Wang Nan
@ 2016-09-21 3:55 ` Wangnan (F)
0 siblings, 0 replies; 5+ messages in thread
From: Wangnan (F) @ 2016-09-21 3:55 UTC (permalink / raw)
To: acme; +Cc: linux-kernel, lizefan, pi3orama, Arnaldo Carvalho de Melo
On 2016/9/21 11:48, Wang Nan wrote:
> Before this patch perf panic if kptr_restrict set to 1 and perf is owned
> by root with suid set:
>
> $ whoami
> wangnan
> $ ls -l ./perf
> -rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
> $ cat /proc/sys/kernel/kptr_restrict
> 1
> $ cat /proc/sys/kernel/perf_event_paranoid
> -1
> $ ./perf record -a
> Segmentation fault (core dumped)
>
> The reason is perf assumes it is allowed to read kptr from /proc/kallsyms
> when euid is root, but in fact kernel doesn't allow it reading kptr when
> euid and uid are not match with each other:
>
> $ cp /bin/cat .
> $ sudo chown root:root ./cat
> $ sudo chmod u+s ./cat
> $ cat /proc/kallsyms | grep do_fork
> 0000000000000000 T _do_fork <--- kptr is hidden even euid is root
> $ sudo cat /proc/kallsyms | grep do_fork
> ffffffff81080230 T _do_fork
>
> See lib/vsprintf.c for kernel side code.
>
> This patch fixes this problem by checking both uid and euid.
>
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> ---
> tools/perf/util/symbol.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
> index 19c9c55..9528702 100644
> --- a/tools/perf/util/symbol.c
> +++ b/tools/perf/util/symbol.c
> @@ -1946,8 +1946,9 @@ static bool symbol__read_kptr_restrict(void)
> if (fp != NULL) {
> char line[8];
>
> +
Sorry for this blank line. Will fix it.
> if (fgets(line, sizeof(line), fp) != NULL)
> - value = (geteuid() != 0) ?
> + value = ((geteuid() != 0) || (getuid() != 0)) ?
> (atoi(line) != 0) :
> (atoi(line) == 2);
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1
@ 2016-09-21 3:56 Wang Nan
2016-09-22 15:41 ` Arnaldo Carvalho de Melo
0 siblings, 1 reply; 5+ messages in thread
From: Wang Nan @ 2016-09-21 3:56 UTC (permalink / raw)
To: acme; +Cc: linux-kernel, lizefan, pi3orama, Wang Nan, Arnaldo Carvalho de Melo
Before this patch perf panic if kptr_restrict set to 1 and perf is owned
by root with suid set:
$ whoami
wangnan
$ ls -l ./perf
-rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
$ cat /proc/sys/kernel/kptr_restrict
1
$ cat /proc/sys/kernel/perf_event_paranoid
-1
$ ./perf record -a
Segmentation fault (core dumped)
The reason is perf assumes it is allowed to read kptr from /proc/kallsyms
when euid is root, but in fact kernel doesn't allow it reading kptr when
euid and uid are not match with each other:
$ cp /bin/cat .
$ sudo chown root:root ./cat
$ sudo chmod u+s ./cat
$ cat /proc/kallsyms | grep do_fork
0000000000000000 T _do_fork <--- kptr is hidden even euid is root
$ sudo cat /proc/kallsyms | grep do_fork
ffffffff81080230 T _do_fork
See lib/vsprintf.c for kernel side code.
This patch fixes this problem by checking both uid and euid.
Signed-off-by: Wang Nan <wangnan0@huawei.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
---
Resend with a meanless blank like removed.
---
tools/perf/util/symbol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 19c9c55..c55e781 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1947,7 +1947,7 @@ static bool symbol__read_kptr_restrict(void)
char line[8];
if (fgets(line, sizeof(line), fp) != NULL)
- value = (geteuid() != 0) ?
+ value = ((geteuid() != 0) || (getuid() != 0)) ?
(atoi(line) != 0) :
(atoi(line) == 2);
--
1.8.3.4
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1
2016-09-21 3:56 Wang Nan
@ 2016-09-22 15:41 ` Arnaldo Carvalho de Melo
2016-09-23 7:00 ` Wangnan (F)
0 siblings, 1 reply; 5+ messages in thread
From: Arnaldo Carvalho de Melo @ 2016-09-22 15:41 UTC (permalink / raw)
To: Wang Nan
Cc: linux-kernel, lizefan, pi3orama, Arnaldo Carvalho de Melo,
Jiri Olsa, Namhyung Kim, David Ahern, Adrian Hunter
Em Wed, Sep 21, 2016 at 03:56:20AM +0000, Wang Nan escreveu:
> Before this patch perf panic if kptr_restrict set to 1 and perf is owned
> by root with suid set:
>
> $ whoami
> wangnan
> $ ls -l ./perf
> -rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
> $ cat /proc/sys/kernel/kptr_restrict
> 1
> $ cat /proc/sys/kernel/perf_event_paranoid
> -1
> $ ./perf record -a
> Segmentation fault (core dumped)
Trying to reproduce this here, and failing, where am I making a mistake?
> The reason is perf assumes it is allowed to read kptr from /proc/kallsyms
> when euid is root, but in fact kernel doesn't allow it reading kptr when
> euid and uid are not match with each other:
> $ cp /bin/cat .
> $ sudo chown root:root ./cat
> $ sudo chmod u+s ./cat
> $ cat /proc/kallsyms | grep do_fork
> 0000000000000000 T _do_fork <--- kptr is hidden even euid is root
> $ sudo cat /proc/kallsyms | grep do_fork
> ffffffff81080230 T _do_fork
>
> See lib/vsprintf.c for kernel side code.
>
> This patch fixes this problem by checking both uid and euid.
Humm, can't we just do:
- value = (geteuid() != 0) ?
+ value = (getuid() != 0) ?
I did it here and it seems to work:
[acme@jouet linux]$ whoami
acme
[acme@jouet linux]$ ls -la ~/bin/perf
-rwsr-xr-x. 2 root root 15539952 Sep 22 12:38 /home/acme/bin/perf
[acme@jouet linux]$ cat /proc/sys/kernel/kptr_restrict
1
[acme@jouet linux]$ cat /proc/sys/kernel/perf_event_paranoid
-1
[acme@jouet linux]$ ~acme/bin/perf record -a
Warning: File /home/acme/.perfconfig not owned by current user or root, ignoring it.
WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted,
check /proc/sys/kernel/kptr_restrict.
Samples in kernel functions may not be resolved if a suitable vmlinux
file is not found in the buildid cache or in the vmlinux path.
Samples in kernel modules won't be resolved at all.
If some relocation was applied (e.g. kexec) symbols may be misresolved
even with a suitable vmlinux or kallsyms file.
Couldn't record kernel reference relocation symbol
Symbol resolution may be skewed if relocation was used (e.g. kexec).
Check /proc/kallsyms permission or run as root.
^C[ perf record: Woken up 17 times to write data ]
[ perf record: Captured and wrote 6.474 MB perf.data (90771 samples) ]
[acme@jouet linux]$ perf report -D 2>&1 | grep PERF_RECORD_SAMPLE | wc -l
90770
[acme@jouet linux]$ perf evlist
Warning: File /home/acme/.perfconfig not owned by current user or root, ignoring it.
cycles:ppp
[acme@jouet linux]$ ls -la ~/.perfconfig
-rw-rw-r--. 1 acme acme 27 Aug 12 17:57 /home/acme/.perfconfig
[acme@jouet linux]$
- Arnaldo
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> ---
>
> Resend with a meanless blank like removed.
>
> ---
> tools/perf/util/symbol.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
> index 19c9c55..c55e781 100644
> --- a/tools/perf/util/symbol.c
> +++ b/tools/perf/util/symbol.c
> @@ -1947,7 +1947,7 @@ static bool symbol__read_kptr_restrict(void)
> char line[8];
>
> if (fgets(line, sizeof(line), fp) != NULL)
> - value = (geteuid() != 0) ?
> + value = ((geteuid() != 0) || (getuid() != 0)) ?
> (atoi(line) != 0) :
> (atoi(line) == 2);
>
> --
> 1.8.3.4
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1
2016-09-22 15:41 ` Arnaldo Carvalho de Melo
@ 2016-09-23 7:00 ` Wangnan (F)
0 siblings, 0 replies; 5+ messages in thread
From: Wangnan (F) @ 2016-09-23 7:00 UTC (permalink / raw)
To: Arnaldo Carvalho de Melo
Cc: linux-kernel, lizefan, pi3orama, Arnaldo Carvalho de Melo,
Jiri Olsa, Namhyung Kim, David Ahern, Adrian Hunter
On 2016/9/22 23:41, Arnaldo Carvalho de Melo wrote:
> Em Wed, Sep 21, 2016 at 03:56:20AM +0000, Wang Nan escreveu:
>> Before this patch perf panic if kptr_restrict set to 1 and perf is owned
>> by root with suid set:
>>
>> $ whoami
>> wangnan
>> $ ls -l ./perf
>> -rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
>> $ cat /proc/sys/kernel/kptr_restrict
>> 1
>> $ cat /proc/sys/kernel/perf_event_paranoid
>> -1
>> $ ./perf record -a
>> Segmentation fault (core dumped)
> Trying to reproduce this here, and failing, where am I making a mistake?
>
>
I tried again. Not related to paranoid. If
/proc/sys/kernel/kptr_restrict is set to
1 and perf runs with (euid == 0 && uid != 0) it will panic at:
int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
...
kmap = map__kmap(map);
size = snprintf(event->mmap.filename, sizeof(event->mmap.filename),
"%s%s", mmap_name, kmap->ref_reloc_sym->name) +
1; <-- *kmap->ref_reloc_sym is NULL*
...
}
because following function:
machine__create_kernel_maps
machine__get_running_kernel_start
returns NULL, so kmap->ref_reloc_sym is never set.
No-root user never get the crash point because in
perf_event__synthesize_kernel_mmap()
symbol_conf.kptr_restrict is true so perf_event__synthesize_kernel_mmap
directly returns
fail.
Have you tried following 'cat' test?
>> The reason is perf assumes it is allowed to read kptr from /proc/kallsyms
>> when euid is root, but in fact kernel doesn't allow it reading kptr when
>> euid and uid are not match with each other:
>
>> $ cp /bin/cat .
>> $ sudo chown root:root ./cat
>> $ sudo chmod u+s ./cat
>> $ cat /proc/kallsyms | grep do_fork
>> 0000000000000000 T _do_fork <--- kptr is hidden even euid is root
>> $ sudo cat /proc/kallsyms | grep do_fork
>> ffffffff81080230 T _do_fork
>>
>> See lib/vsprintf.c for kernel side code.
>>
>> This patch fixes this problem by checking both uid and euid.
> Humm, can't we just do:
>
> - value = (geteuid() != 0) ?
> + value = (getuid() != 0) ?
No. though not very useful, by chown u+s one can make ((uid == 0) &&
(euid != 0)) by:
# chown wangnan:wangnan ./perf
# chmod u+s ./perf
Then perf fail if run by root:
# ./perf record -a
Segmentation fault (core dumped)
But okay for normal user.
Thank you.
> I did it here and it seems to work:
>
> [acme@jouet linux]$ whoami
> acme
> [acme@jouet linux]$ ls -la ~/bin/perf
> -rwsr-xr-x. 2 root root 15539952 Sep 22 12:38 /home/acme/bin/perf
> [acme@jouet linux]$ cat /proc/sys/kernel/kptr_restrict
> 1
> [acme@jouet linux]$ cat /proc/sys/kernel/perf_event_paranoid
> -1
> [acme@jouet linux]$ ~acme/bin/perf record -a
> Warning: File /home/acme/.perfconfig not owned by current user or root, ignoring it.
> WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted,
> check /proc/sys/kernel/kptr_restrict.
>
> Samples in kernel functions may not be resolved if a suitable vmlinux
> file is not found in the buildid cache or in the vmlinux path.
>
> Samples in kernel modules won't be resolved at all.
>
> If some relocation was applied (e.g. kexec) symbols may be misresolved
> even with a suitable vmlinux or kallsyms file.
>
> Couldn't record kernel reference relocation symbol
> Symbol resolution may be skewed if relocation was used (e.g. kexec).
> Check /proc/kallsyms permission or run as root.
> ^C[ perf record: Woken up 17 times to write data ]
> [ perf record: Captured and wrote 6.474 MB perf.data (90771 samples) ]
>
> [acme@jouet linux]$ perf report -D 2>&1 | grep PERF_RECORD_SAMPLE | wc -l
> 90770
> [acme@jouet linux]$ perf evlist
> Warning: File /home/acme/.perfconfig not owned by current user or root, ignoring it.
> cycles:ppp
> [acme@jouet linux]$ ls -la ~/.perfconfig
> -rw-rw-r--. 1 acme acme 27 Aug 12 17:57 /home/acme/.perfconfig
> [acme@jouet linux]$
>
>
> - Arnaldo
>
>
>> Signed-off-by: Wang Nan <wangnan0@huawei.com>
>> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
>> ---
>>
>> Resend with a meanless blank like removed.
>>
>> ---
>> tools/perf/util/symbol.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
>> index 19c9c55..c55e781 100644
>> --- a/tools/perf/util/symbol.c
>> +++ b/tools/perf/util/symbol.c
>> @@ -1947,7 +1947,7 @@ static bool symbol__read_kptr_restrict(void)
>> char line[8];
>>
>> if (fgets(line, sizeof(line), fp) != NULL)
>> - value = (geteuid() != 0) ?
>> + value = ((geteuid() != 0) || (getuid() != 0)) ?
>> (atoi(line) != 0) :
>> (atoi(line) == 2);
>>
>> --
>> 1.8.3.4
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-09-23 7:01 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-21 3:48 [PATCH] perf record: Fix segfault when running with suid and kptr_restrict is 1 Wang Nan
2016-09-21 3:55 ` Wangnan (F)
2016-09-21 3:56 Wang Nan
2016-09-22 15:41 ` Arnaldo Carvalho de Melo
2016-09-23 7:00 ` Wangnan (F)
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.