Messages in this thread | | | Date | Mon, 13 Mar 2017 16:52:38 -0300 | From | Arnaldo Carvalho de Melo <> | Subject | Re: [PATCH v8 1/6] perf: Add PERF_RECORD_NAMESPACES to include namespaces related info |
| |
Em Wed, Mar 08, 2017 at 02:11:36AM +0530, Hari Bathini escreveu: > @@ -9691,6 +9825,11 @@ SYSCALL_DEFINE5(perf_event_open, > return -EACCES; > } > > + if (attr.namespaces) { > + if (!capable(CAP_SYS_ADMIN)) > + return -EACCES; > + } > +
So, testing the first tooling patch I get:
[acme@jouet linux]$ perf record --namespaces ls Error: You may not have permission to collect stats.
Consider tweaking /proc/sys/kernel/perf_event_paranoid, which controls use of the performance events system by unprivileged users (without CAP_SYS_ADMIN).
The current value is 2:
-1: Allow use of (almost) all events by all users >= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >= 1: Disallow CPU event access by users without CAP_SYS_ADMIN >= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN
To make this setting permanent, edit /etc/sysctl.conf too, e.g.:
kernel.perf_event_paranoid = -1
[acme@jouet linux]$
----------------------- 8< ---------------------------------------
So this specific case is not related to perf_event_paranoid, we need to improve error handling here, i.e. see attr.namespaces, !CAP_SYS_ADMIN, -EACCESS at sys_perf_event_open() -> better error message.
And perhaps we make an extra check about perf_event_paranoid... Ingo? Peter?
Can be done as a follow up patch tho, just adding entry to the collective TODO list.
- Arnaldo
| |