Re: [PATCH v4 12/19] perf test cs-etm: Skip if not root

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] A Time-of-Check to Time-of-Use (TOCTOU) race condition exists due to an unsafe temporary file deletion and recreation pattern, allowing local attackers to modify arbitrary file timestamps or create empty files as root.
--

commit a4b1e28698440010ef2bccdf78c5fee8d8a1850d
Author: James Clark <james.clark@linaro.org>

perf test cs-etm: Skip if not root

This commit adds a root privilege check to the Arm CoreSight trace tests.
It ensures the tests are skipped gracefully with a clear message if the
user running them is not root, as root access is required for certain
testing modes.

> diff --git a/tools/perf/tests/shell/test_arm_coresight.sh b/tools/perf/tests/shell/test_arm_coresight.sh
> index 39553702c1f31..8ed2c934c87d0 100755
> --- a/tools/perf/tests/shell/test_arm_coresight.sh
> +++ b/tools/perf/tests/shell/test_arm_coresight.sh
> @@ -20,6 +20,12 @@ skip_if_no_cs_etm_event() {
>  
>  skip_if_no_cs_etm_event || exit 2
>  
> +if [ "$(id -u)" != 0 ]; then
> +	# Requires root for -C and system wide tests
> +	echo "[Skip] No root permission"
> +	exit 2
> +fi
> +

[Severity: Medium]
This is a pre-existing issue, but by enforcing that this script must run
as root, does this turn an existing race condition into a local privilege
escalation or denial-of-service vector?

Can we fix the temporary file handling here? Currently, the script securely
creates a temporary file but later deletes and recreates it:

tools/perf/tests/shell/test_arm_coresight.sh:record_touch_file() {
    ...
	rm -f $file
	perf record -o ${perfdata} -e cs_etm/@$1/u --per-thread \
		-- taskset -c $2 touch $file > /dev/null 2>&1
}

Since the file is securely created in the world-writable /tmp directory via
mktemp, the rm -f frees the predictable name. An attacker monitoring /tmp
can race to create a symlink at this path after the deletion but before the
root user executes touch.

Would this allow an attacker to modify arbitrary file timestamps or create
empty files as root?

>  perfdata=$(mktemp /tmp/__perf_test.perf.data.XXXXX)
>  file=$(mktemp /tmp/temporary_file.XXXXX)
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609-james-cs-context-tracking-fix-v4-0-44f9fb9e5c42@linaro.org?part=12