lkml.org 
[lkml]   [2019]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH v4 5/9] trace/bpf_trace: open access for CAP_SYS_PERFMON privileged process
    From
    Date

    Open access to bpf_trace monitoring for CAP_SYS_PERFMON privileged
    processes. For backward compatibility reasons access to bpf_trace
    monitoring remains open for CAP_SYS_ADMIN privileged processes but
    CAP_SYS_ADMIN usage for secure bpf_trace monitoring is discouraged
    with respect to CAP_SYS_PERFMON capability.

    Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com>
    ---
    kernel/trace/bpf_trace.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
    index 44bd08f2443b..bafe21ac6d92 100644
    --- a/kernel/trace/bpf_trace.c
    +++ b/kernel/trace/bpf_trace.c
    @@ -1272,7 +1272,7 @@ int perf_event_query_prog_array(struct perf_event *event, void __user *info)
    u32 *ids, prog_cnt, ids_len;
    int ret;

    - if (!capable(CAP_SYS_ADMIN))
    + if (!perfmon_capable())
    return -EPERM;
    if (event->attr.type != PERF_TYPE_TRACEPOINT)
    return -EINVAL;
    --
    2.20.1

    \
     
     \ /
      Last update: 2019-12-18 10:29    [W:4.560 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site