From: Namhyung Kim <namhyung@kernel.org>
To: Ian Rogers <irogers@google.com>
Cc: acme@kernel.org, abyssmystery@gmail.com, adrian.hunter@intel.com,
james.clark@linaro.org, jolsa@kernel.org,
linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org,
mingo@redhat.com, peterz@infradead.org
Subject: Re: [PATCH v3] perf cap: Remove used_root parameter and simplify capability checks
Date: Thu, 23 Jul 2026 22:47:53 -0700 [thread overview]
Message-ID: <amL8icNhBkZvTzEB@google.com> (raw)
In-Reply-To: <20260723050640.992865-1-irogers@google.com>
On Wed, Jul 22, 2026 at 10:06:40PM -0700, Ian Rogers wrote:
> Refactor perf_cap__capable() to completely remove the used_root out-parameter
> as requested by the maintainer. Relying on an explicit used_root boolean
> poisoned sequential capability checks (e.g. failing CAP_SYS_ADMIN checks
> poisoning the flag for subsequent CAP_PERFMON evaluations for unprivileged
> users) and created redundant complexity across check_ftrace_capable(),
> symbol__read_kptr_restrict(), and perf_event_paranoid_check().
>
> Streamline the capability API to perform a pure true/false boolean
> evaluation. The function checks the Effective set using SYS_capget; if
> the syscall is missing or fails on legacy kernels, it cleanly falls back
> to checking EUID == 0. This perfectly preserves modern capability-aware host
> sessions, guarantees transparent fallback for older kernels, and correctly
> rejects privileged operations for containerized root processes that have
> explicitly dropped their capability bounding and permitted sets.
Applied to perf-tools-next, thanks!
Best regards,
Namhyung
next prev parent reply other threads:[~2026-07-24 5:47 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-10 5:39 [PATCH v1 1/2] perf record: Fix teardown hang on system-wide multi-threaded sessions Ian Rogers
2026-07-10 5:39 ` [PATCH v1 2/2] perf cap: If capability is missing still perform root test Ian Rogers
2026-07-10 5:47 ` sashiko-bot
2026-07-10 22:24 ` Namhyung Kim
2026-07-16 7:40 ` [PATCH v2] perf cap: Remove used_root parameter and simplify capability checks Ian Rogers
2026-07-23 5:06 ` [PATCH v3] " Ian Rogers
2026-07-24 5:47 ` Namhyung Kim [this message]
2026-07-10 5:56 ` [PATCH v1 1/2] perf record: Fix teardown hang on system-wide multi-threaded sessions sashiko-bot
2026-07-10 22:02 ` Namhyung Kim
2026-07-12 6:56 ` (subset) " Namhyung Kim
2026-07-16 7:37 ` [PATCH v2] perf record: Fix destructor invocation and event counting in fdarray__filter Ian Rogers
2026-07-16 8:00 ` sashiko-bot
2026-07-23 5:04 ` [PATCH v3] " Ian Rogers
2026-07-23 5:27 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=amL8icNhBkZvTzEB@google.com \
--to=namhyung@kernel.org \
--cc=abyssmystery@gmail.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=irogers@google.com \
--cc=james.clark@linaro.org \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.