[lkml]   [2019]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 0/3] perf: Use capabilities instead of uid and euid
On 03.07.2019 3:10, Igor Lubashev wrote:
> Kernel is using capabilities instead of uid and euid to restrict access to
> kernel pointers and tracing facilities. This patch series updates the perf to
> better match the security model used by the kernel.
> This series enables instructions in Documentation/admin-guide/perf-security.rst
> to actually work, even when kernel.perf_event_paranoid=2 and
> kernel.kptr_restrict=1.
> The series consists of three patches:
> 01: perf: Add capability-related utilities
> Add utility functions to check capabilities and perf_event_paranoid checks.
> 02: perf: Use CAP_SYS_ADMIN with perf_event_paranoid checks
> Replace the use of euid==0 with a check for CAP_SYS_ADMIN whenever
> perf_event_paranoid level is verified.
> 03: perf: Use CAP_SYSLOG with kptr_restrict checks
> Replace the use of uid and euid with a check for CAP_SYSLOG when
> kptr_restrict is verified (similar to kernel/kallsyms.c and lib/vsprintf.c).
> Consult perf_event_paranoid when kptr_restrict==0 (see kernel/kallsyms.c).
> I tested this by following Documentation/admin-guide/perf-security.rst
> guidelines and setting sysctls:
> kernel.perf_event_paranoid=2
> kernel.kptr_restrict=1
> As an unpriviledged user who is in perf_users group (setup via instructions
> above), I executed:
> perf record -a -- sleep 1
> Without the patch, perf record did not capture any kernel functions.
> With the patch, perf included all kernel funcitons.

Acked-by: Alexey Budankov <>

Valuable contribution, thanks! And I see the continuation of the effort started
in this patch set. Some dedicated CAP_SYS_PERFMON capability could be introduced
and used for performance monitoring related security checks, as in the kernel as
in the user mode, because CAP_SYS_ADMIN grants much wider credentials that are
required, at least for Perf related monitoring and, yet more, CAP_SYS_ADMIN could
be unloaded addressing the concerns here [1]:

Note: this capability is overloaded; see Notes to kernel developers, below.
Notes to kernel developers:
When adding a new kernel feature that should be governed by a
capability, consider the following points.
* The goal of capabilities is divide the power of superuser into
pieces, such that if a program that has one or more capabilities
is compromised, its power to do damage to the system would be less
than the same program running with root privilege.
* You have the choice of either creating a new capability for your
new feature, or associating the feature with one of the existing
capabilities. In order to keep the set of capabilities to a
manageable size, the latter option is preferable, unless there are
compelling reasons to take the former option. (There is also a
technical limit: the size of capability sets is currently limited
to 64 bits.)
. . .
* Don't choose CAP_SYS_ADMIN if you can possibly avoid it! A vast
proportion of existing capability checks are associated with this
capability (see the partial list above). It can plausibly be
called "the new root", since on the one hand, it confers a wide
range of powers, and on the other hand, its broad scope means that
this is the capability that is required by many privileged
programs. Don't make the problem worse. The only new features
that should be associated with CAP_SYS_ADMIN are ones that closely
match existing uses in that silo.
* If you have determined that it really is necessary to create a new
capability for your feature, don't make or name it as a "single-
use" capability. Thus, for example, the addition of the highly
specific CAP_SYS_PACCT was probably a mistake. Instead, try to
identify and name your new capability as a broader silo into which
other related future use cases might fit.”



> Igor Lubashev (3):
> perf: Add capability-related utilities
> perf: Use CAP_SYS_ADMIN with perf_event_paranoid checks
> perf: Use CAP_SYSLOG with kptr_restrict checks
> tools/perf/Makefile.config | 2 +-
> tools/perf/arch/arm/util/cs-etm.c | 3 ++-
> tools/perf/arch/arm64/util/arm-spe.c | 3 ++-
> tools/perf/arch/x86/util/intel-bts.c | 3 ++-
> tools/perf/arch/x86/util/intel-pt.c | 2 +-
> tools/perf/util/Build | 1 +
> tools/perf/util/cap.c | 24 ++++++++++++++++++++++++
> tools/perf/util/cap.h | 10 ++++++++++
> tools/perf/util/event.h | 1 +
> tools/perf/util/evsel.c | 2 +-
> tools/perf/util/python-ext-sources | 1 +
> tools/perf/util/symbol.c | 15 +++++++++++----
> tools/perf/util/util.c | 9 +++++++++
> 13 files changed, 66 insertions(+), 10 deletions(-)
> create mode 100644 tools/perf/util/cap.c
> create mode 100644 tools/perf/util/cap.h

 \ /
  Last update: 2019-07-16 12:52    [W:0.129 / U:30.552 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site