lkml.org 
[lkml]   [2009]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 1/4] perf_counter: Default to higher paranoia level
    From
    Date
    On Wed, 2009-08-19 at 11:18 +0200, Peter Zijlstra wrote:

    > +static inline bool perf_paranoid_anon(void)
    > +{
    > + return !capable(CAP_SYS_ADMIN) && sysctl_perf_counter_paranoid > 1;
    > }
    >
    > static inline bool perf_paranoid_kernel(void)
    > {
    > - return sysctl_perf_counter_paranoid > 1;
    > + return !capable(CAP_SYS_ADMIN) && sysctl_perf_counter_paranoid > 2;
    > +}

    OK, this is buggy:

    - capable() uses current, which is unlikely to be counter->owner,
    - but even security_real_capable(counter->owner, ...) wouldn't
    work, since the ->capable() callback isn't NMI safe
    (selinux takes locks and does allocations in that path).

    This puts a severe strain on more complex anonymizers since its
    basically impossible to tell if counter->owner has permissions on
    current from NMI context.

    I'll fix up this patch to pre-compute the perf_paranoid_anon_ip() per
    counter based on creation time state, unless somebody has a better idea.

    I could possibly only anonymize IRQ context (SoftIRQ context is
    difficult since in_softirq() means both in-softirq and
    softirq-disabled).





    \
     
     \ /
      Last update: 2009-08-19 16:09    [W:0.022 / U:268.008 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site