From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: Ingo Molnar <mingo@kernel.org>
Cc: linux-kernel@vger.kernel.org, Wang Nan <wangnan0@huawei.com>,
Alexei Starovoitov <ast@fb.com>, He Kuang <hekuang@huawei.com>,
Zefan Li <lizefan@huawei.com>,
pi3orama@163.com, Arnaldo Carvalho de Melo <acme@redhat.com>
Subject: [PATCH 10/12] perf record: Fix segfault when running with suid and kptr_restrict is 1
Date: Fri, 25 Nov 2016 12:12:25 -0300 [thread overview]
Message-ID: <1480086747-2393-11-git-send-email-acme@kernel.org> (raw)
In-Reply-To: <1480086747-2393-1-git-send-email-acme@kernel.org>
From: Wang Nan <wangnan0@huawei.com>
Before this patch perf panics if kptr_restrict is set to 1 and perf is
owned by root with suid set:
$ whoami
wangnan
$ ls -l ./perf
-rwsr-xr-x 1 root root 19781908 Sep 21 19:29 /home/wangnan/perf
$ cat /proc/sys/kernel/kptr_restrict
1
$ cat /proc/sys/kernel/perf_event_paranoid
-1
$ ./perf record -a
Segmentation fault (core dumped)
$
The reason is that perf assumes it is allowed to read kptr from
/proc/kallsyms when euid is root, but in fact the kernel doesn't allow
reading kptr when euid and uid do not match with each other:
$ cp /bin/cat .
$ sudo chown root:root ./cat
$ sudo chmod u+s ./cat
$ cat /proc/kallsyms | grep do_fork
0000000000000000 T _do_fork <--- kptr is hidden even euid is root
$ sudo cat /proc/kallsyms | grep do_fork
ffffffff81080230 T _do_fork
See lib/vsprintf.c for kernel side code.
This patch fixes this problem by checking both uid and euid.
Signed-off-by: Wang Nan <wangnan0@huawei.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: He Kuang <hekuang@huawei.com>
Cc: Zefan Li <lizefan@huawei.com>
Cc: pi3orama@163.com
Link: http://lkml.kernel.org/r/20161115040617.69788-3-wangnan0@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/symbol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index aecff69a510d..420ada9de22f 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1962,7 +1962,7 @@ static bool symbol__read_kptr_restrict(void)
char line[8];
if (fgets(line, sizeof(line), fp) != NULL)
- value = (geteuid() != 0) ?
+ value = ((geteuid() != 0) || (getuid() != 0)) ?
(atoi(line) != 0) :
(atoi(line) == 2);
--
2.7.4
next prev parent reply other threads:[~2016-11-25 15:13 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-25 15:12 [GIT PULL 00/12] perf/core improvements and fixes Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 01/12] perf annotate: Remove duplicate 'name' field from disasm_line Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 02/12] perf annotate: Introduce alternative method of keeping instructions table Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 03/12] perf annotate: Allow arches to have a init routine and a priv area Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 04/12] perf annotate: Improve support for ARM Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 05/12] perf annotate: Initial PowerPC support Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 06/12] perf callchain: Add option to skip ignore symbol when printing callchains Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 07/12] perf sched timehist: Mark schedule function in callchains Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 08/12] perf sched timehist: Enlarge max stack depth by 2 Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 09/12] perf tools: Fix kernel version error in ubuntu Arnaldo Carvalho de Melo
2016-11-25 15:12 ` Arnaldo Carvalho de Melo [this message]
2016-11-25 15:12 ` [PATCH 11/12] perf tools: Add missing struct definition in probe_event.h Arnaldo Carvalho de Melo
2016-11-25 15:12 ` [PATCH 12/12] tools lib bpf: Fix maps resolution Arnaldo Carvalho de Melo
2016-11-25 17:14 ` [GIT PULL 00/12] perf/core improvements and fixes Ingo Molnar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1480086747-2393-11-git-send-email-acme@kernel.org \
--to=acme@kernel.org \
--cc=acme@redhat.com \
--cc=ast@fb.com \
--cc=hekuang@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=mingo@kernel.org \
--cc=pi3orama@163.com \
--cc=wangnan0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.