From: Jiri Olsa <jolsa@redhat.com>
To: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>,
Arnaldo Carvalho de Melo <acme@kernel.org>,
Alexei Starovoitov <ast@kernel.org>,
Ingo Molnar <mingo@redhat.com>, James Morris <jmorris@namei.org>,
Namhyung Kim <namhyung@kernel.org>,
Serge Hallyn <serge@hallyn.com>, Song Liu <songliubraving@fb.com>,
Andi Kleen <ak@linux.intel.com>,
Stephane Eranian <eranian@google.com>,
Igor Lubashev <ilubashe@akamai.com>,
Thomas Gleixner <tglx@linutronix.de>,
linux-kernel <linux-kernel@vger.kernel.org>,
"linux-security-module@vger.kernel.org"
<linux-security-module@vger.kernel.org>,
"selinux@vger.kernel.org" <selinux@vger.kernel.org>,
"intel-gfx@lists.freedesktop.org"
<intel-gfx@lists.freedesktop.org>,
"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
linux-man@vger.kernel.org
Subject: Re: [PATCH v8 04/12] perf tool: extend Perf tool with CAP_PERFMON capability support
Date: Fri, 3 Apr 2020 13:08:28 +0200 [thread overview]
Message-ID: <20200403110828.GL2784502@krava> (raw)
In-Reply-To: <a66d5648-2b8e-577e-e1f2-1d56c017ab5e@linux.intel.com>
On Thu, Apr 02, 2020 at 11:47:35AM +0300, Alexey Budankov wrote:
>
> Extend error messages to mention CAP_PERFMON capability as an option
> to substitute CAP_SYS_ADMIN capability for secure system performance
> monitoring and observability operations. Make perf_event_paranoid_check()
> and __cmd_ftrace() to be aware of CAP_PERFMON capability.
>
> CAP_PERFMON implements the principal of least privilege for performance
> monitoring and observability operations (POSIX IEEE 1003.1e 2.2.2.39
> principle of least privilege: A security design principle that states
> that a process or program be granted only those privileges (e.g.,
> capabilities) necessary to accomplish its legitimate function, and only
> for the time that such privileges are actually required)
>
> For backward compatibility reasons access to perf_events subsystem remains
> open for CAP_SYS_ADMIN privileged processes but CAP_SYS_ADMIN usage for
> secure perf_events monitoring is discouraged with respect to CAP_PERFMON
> capability.
>
> Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com>
> Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
thanks,
jirka
> ---
> tools/perf/builtin-ftrace.c | 5 +++--
> tools/perf/design.txt | 3 ++-
> tools/perf/util/cap.h | 4 ++++
> tools/perf/util/evsel.c | 10 +++++-----
> tools/perf/util/util.c | 1 +
> 5 files changed, 15 insertions(+), 8 deletions(-)
>
> diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
> index d5adc417a4ca..55eda54240fb 100644
> --- a/tools/perf/builtin-ftrace.c
> +++ b/tools/perf/builtin-ftrace.c
> @@ -284,10 +284,11 @@ static int __cmd_ftrace(struct perf_ftrace *ftrace, int argc, const char **argv)
> .events = POLLIN,
> };
>
> - if (!perf_cap__capable(CAP_SYS_ADMIN)) {
> + if (!(perf_cap__capable(CAP_PERFMON) ||
> + perf_cap__capable(CAP_SYS_ADMIN))) {
> pr_err("ftrace only works for %s!\n",
> #ifdef HAVE_LIBCAP_SUPPORT
> - "users with the SYS_ADMIN capability"
> + "users with the CAP_PERFMON or CAP_SYS_ADMIN capability"
> #else
> "root"
> #endif
> diff --git a/tools/perf/design.txt b/tools/perf/design.txt
> index 0453ba26cdbd..a42fab308ff6 100644
> --- a/tools/perf/design.txt
> +++ b/tools/perf/design.txt
> @@ -258,7 +258,8 @@ gets schedule to. Per task counters can be created by any user, for
> their own tasks.
>
> A 'pid == -1' and 'cpu == x' counter is a per CPU counter that counts
> -all events on CPU-x. Per CPU counters need CAP_SYS_ADMIN privilege.
> +all events on CPU-x. Per CPU counters need CAP_PERFMON or CAP_SYS_ADMIN
> +privilege.
>
> The 'flags' parameter is currently unused and must be zero.
>
> diff --git a/tools/perf/util/cap.h b/tools/perf/util/cap.h
> index 051dc590ceee..ae52878c0b2e 100644
> --- a/tools/perf/util/cap.h
> +++ b/tools/perf/util/cap.h
> @@ -29,4 +29,8 @@ static inline bool perf_cap__capable(int cap __maybe_unused)
> #define CAP_SYSLOG 34
> #endif
>
> +#ifndef CAP_PERFMON
> +#define CAP_PERFMON 38
> +#endif
> +
> #endif /* __PERF_CAP_H */
> diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
> index 816d930d774e..2696922f06bc 100644
> --- a/tools/perf/util/evsel.c
> +++ b/tools/perf/util/evsel.c
> @@ -2507,14 +2507,14 @@ int perf_evsel__open_strerror(struct evsel *evsel, struct target *target,
> "You may not have permission to collect %sstats.\n\n"
> "Consider tweaking /proc/sys/kernel/perf_event_paranoid,\n"
> "which controls use of the performance events system by\n"
> - "unprivileged users (without CAP_SYS_ADMIN).\n\n"
> + "unprivileged users (without CAP_PERFMON or CAP_SYS_ADMIN).\n\n"
> "The current value is %d:\n\n"
> " -1: Allow use of (almost) all events by all users\n"
> " Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK\n"
> - ">= 0: Disallow ftrace function tracepoint by users without CAP_SYS_ADMIN\n"
> - " Disallow raw tracepoint access by users without CAP_SYS_ADMIN\n"
> - ">= 1: Disallow CPU event access by users without CAP_SYS_ADMIN\n"
> - ">= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN\n\n"
> + ">= 0: Disallow ftrace function tracepoint by users without CAP_PERFMON or CAP_SYS_ADMIN\n"
> + " Disallow raw tracepoint access by users without CAP_SYS_PERFMON or CAP_SYS_ADMIN\n"
> + ">= 1: Disallow CPU event access by users without CAP_PERFMON or CAP_SYS_ADMIN\n"
> + ">= 2: Disallow kernel profiling by users without CAP_PERFMON or CAP_SYS_ADMIN\n\n"
> "To make this setting permanent, edit /etc/sysctl.conf too, e.g.:\n\n"
> " kernel.perf_event_paranoid = -1\n" ,
> target->system_wide ? "system-wide " : "",
> diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
> index d707c9624dd9..37a9492edb3e 100644
> --- a/tools/perf/util/util.c
> +++ b/tools/perf/util/util.c
> @@ -290,6 +290,7 @@ int perf_event_paranoid(void)
> bool perf_event_paranoid_check(int max_level)
> {
> return perf_cap__capable(CAP_SYS_ADMIN) ||
> + perf_cap__capable(CAP_PERFMON) ||
> perf_event_paranoid() <= max_level;
> }
>
> --
> 2.24.1
>
next prev parent reply other threads:[~2020-04-03 11:08 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-02 8:42 [PATCH v8 00/12] Introduce CAP_PERFMON to secure system performance monitoring and observability Alexey Budankov
2020-04-02 8:45 ` [PATCH v8 01/12] capabilities: introduce CAP_PERFMON to kernel and user space Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] capabilities: Introduce " tip-bot2 for Alexey Budankov
2020-04-02 8:46 ` [PATCH v8 02/12] perf/core: open access to the core for CAP_PERFMON privileged process Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] perf/core: Open " tip-bot2 for Alexey Budankov
2020-04-02 8:47 ` [PATCH v8 03/12] perf/core: open access to probes " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] " tip-bot2 for Alexey Budankov
2020-04-02 8:47 ` [PATCH v8 04/12] perf tool: extend Perf tool with CAP_PERFMON capability support Alexey Budankov
2020-04-03 11:08 ` Jiri Olsa [this message]
2020-04-03 13:08 ` Alexey Budankov
2020-04-04 2:18 ` Namhyung Kim
2020-04-04 8:18 ` Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] perf tools: Support CAP_PERFMON capability tip-bot2 for Alexey Budankov
2020-04-02 8:48 ` [PATCH v8 05/12] drm/i915/perf: open access for CAP_PERFMON privileged process Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] drm/i915/perf: Open " tip-bot2 for Alexey Budankov
2020-04-02 8:48 ` [PATCH v8 06/12] trace/bpf_trace: open " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] trace/bpf_trace: Open " tip-bot2 for Alexey Budankov
2020-04-02 8:49 ` [PATCH v8 07/12] powerpc/perf: open " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] " tip-bot2 for Alexey Budankov
2020-04-02 8:50 ` [PATCH v8 08/12] parisc/perf: " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] " tip-bot2 for Alexey Budankov
2020-04-02 8:51 ` [PATCH v8 09/12] drivers/perf: " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] drivers/perf: Open " tip-bot2 for Alexey Budankov
2020-04-02 8:53 ` [PATCH v8 10/12] drivers/oprofile: open " Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] drivers/oprofile: Open " tip-bot2 for Alexey Budankov
2020-04-02 8:54 ` [PATCH v8 11/12] doc/admin-guide: update perf-security.rst with CAP_PERFMON information Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] doc/admin-guide: Update " tip-bot2 for Alexey Budankov
2020-04-02 8:54 ` [PATCH v8 12/12] doc/admin-guide: update kernel.rst " Alexey Budankov
2020-04-05 14:10 ` Arnaldo Carvalho de Melo
2020-04-05 14:41 ` Alexey Budankov
2020-04-05 14:54 ` Alexey Budankov
2020-04-05 15:05 ` Arnaldo Carvalho de Melo
2020-04-05 15:51 ` Alexey Budankov
2020-04-22 12:17 ` [tip: perf/core] " tip-bot2 for Alexey Budankov
2020-04-07 14:30 ` [PATCH v8 00/12] Introduce CAP_PERFMON to secure system performance monitoring and observability Arnaldo Carvalho de Melo
2020-04-07 14:35 ` Arnaldo Carvalho de Melo
2020-04-07 14:54 ` Alexey Budankov
2020-04-07 16:36 ` Arnaldo Carvalho de Melo
2020-04-07 16:40 ` Arnaldo Carvalho de Melo
2020-04-07 17:17 ` Alexey Budankov
2020-04-07 16:52 ` Alexey Budankov
2020-04-07 17:02 ` Arnaldo Carvalho de Melo
2020-04-07 17:32 ` Alexey Budankov
2020-04-07 16:56 ` Arnaldo Carvalho de Melo
2020-04-07 17:23 ` Arnaldo Carvalho de Melo
2020-07-10 13:31 ` Ravi Bangoria
2020-07-10 14:30 ` Alexey Budankov
2020-07-10 17:09 ` Arnaldo Carvalho de Melo
2020-07-13 9:48 ` Alexey Budankov
2020-07-13 12:17 ` Arnaldo Carvalho de Melo
2020-07-13 12:37 ` Alexey Budankov
2020-07-13 18:51 ` Arnaldo Carvalho de Melo
2020-07-14 10:59 ` Peter Zijlstra
2020-07-14 15:27 ` Arnaldo Carvalho de Melo
2020-07-21 13:06 ` Alexey Budankov
2020-07-22 11:30 ` Arnaldo Carvalho de Melo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200403110828.GL2784502@krava \
--to=jolsa@redhat.com \
--cc=acme@kernel.org \
--cc=ak@linux.intel.com \
--cc=alexey.budankov@linux.intel.com \
--cc=ast@kernel.org \
--cc=eranian@google.com \
--cc=ilubashe@akamai.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jmorris@namei.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-man@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=peterz@infradead.org \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=songliubraving@fb.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).