[PATCH] perfcounters: allow sysadmin to restrict non-root counting of kernel events

[PATCH] perfcounters: allow sysadmin to restrict non-root counting of kernel events

[Paul Mackerras]

Impact: security feature

This allows the sysadmin to prevent non-root users from counting
hardware events that occur in kernel or hypervisor mode via a sysfs file:

	/sys/devices/system/cpu/perf_counters/restrict_kernel_events

This defaults to off (0), allowing users to count kernel and hypervisor
events, but if the sysadmin writes 1 to that file, any new counters
created by non-root users will automatically be set to ignore kernel
and hypervisor events.

This could be useful if there is a concern that allowing non-root users
to count kernel or hypervisor events might leak sensitive information.

Signed-off-by: Paul Mackerras <paulus@samba.org>
---
This is available in my perfcounters.git tree master branch at:

git://git.kernel.org/pub/scm/linux/kernel/git/paulus/perfcounters.git master

 kernel/perf_counter.c |   46 +++++++++++++++++++++++++++++++++++++++++++++-
 1 files changed, 45 insertions(+), 1 deletions(-)

diff --git a/kernel/perf_counter.c b/kernel/perf_counter.c
index ad62965..7967272 100644
--- a/kernel/perf_counter.c
+++ b/kernel/perf_counter.c
@@ -31,6 +31,7 @@ DEFINE_PER_CPU(struct perf_cpu_context, perf_cpu_context);
 int perf_max_counters __read_mostly = 1;
 static int perf_reserved_percpu __read_mostly;
 static int perf_overcommit __read_mostly = 1;
+static int perf_counters_strict __read_mostly;
 
 /*
  * Mutex for (sysadmin-configurable) counter reservations:
@@ -1670,8 +1671,21 @@ perf_counter_alloc(struct perf_counter_hw_event *hw_event,
 	hw_ops = NULL;
 	if (!hw_event->raw && hw_event->type < 0)
 		hw_ops = sw_perf_counter_init(counter);
-	else
+	else {
+		/*
+		 * If the user is not root and the restrict_kernel_events
+		 * policy is in force, make sure we exclude kernel and
+		 * hypervisor events from hardware events.  (We don't have
+		 * any capability to distinguish user, kernel and hypervisor
+		 * events in our software counters.)
+		 */
+		if (!capable(CAP_SYS_ADMIN) && perf_counters_strict) {
+			counter->hw_event.exclude_kernel = 1;
+			counter->hw_event.exclude_hv = 1;
+		}
+
 		hw_ops = hw_perf_counter_init(counter);
+	}
 
 	if (!hw_ops) {
 		kfree(counter);
@@ -2175,6 +2189,28 @@ perf_set_overcommit(struct sysdev_class *class, const char *buf, size_t count)
 	return count;
 }
 
+static ssize_t perf_show_strict(struct sysdev_class *class, char *buf)
+{
+	return sprintf(buf, "%d\n", perf_counters_strict);
+}
+
+static ssize_t
+perf_set_strict(struct sysdev_class *class, const char *buf, size_t count)
+{
+	unsigned long val;
+	int err;
+
+	err = strict_strtoul(buf, 10, &val);
+	if (err)
+		return err;
+	if (val > 1)
+		return -EINVAL;
+
+	perf_counters_strict = val;
+
+	return count;
+}
+
 static SYSDEV_CLASS_ATTR(
 				reserve_percpu,
 				0644,
@@ -2189,9 +2225,17 @@ static SYSDEV_CLASS_ATTR(
 				perf_set_overcommit
 			);
 
+static SYSDEV_CLASS_ATTR(
+				restrict_kernel_events,
+				0644,
+				perf_show_strict,
+				perf_set_strict
+			);
+
 static struct attribute *perfclass_attrs[] = {
 	&attr_reserve_percpu.attr,
 	&attr_overcommit.attr,
+	&attr_restrict_kernel_events.attr,
 	NULL
 };
 
-- 
1.5.6.3

Re: [PATCH] perfcounters: allow sysadmin to restrict non-root counting of kernel events

[Peter Zijlstra]

On Wed, 2009-02-18 at 21:26 +1100, Paul Mackerras wrote:
> Impact: security feature
> 
> This allows the sysadmin to prevent non-root users from counting
> hardware events that occur in kernel or hypervisor mode via a sysfs file:
> 
> 	/sys/devices/system/cpu/perf_counters/restrict_kernel_events
> 
> This defaults to off (0), allowing users to count kernel and hypervisor
> events, but if the sysadmin writes 1 to that file, any new counters
> created by non-root users will automatically be set to ignore kernel
> and hypervisor events.
> 
> This could be useful if there is a concern that allowing non-root users
> to count kernel or hypervisor events might leak sensitive information.

I would expect it the other way around, don't allow users access to
kernel/hv events unless explicitly granted.

Re: [PATCH] perfcounters: allow sysadmin to restrict non-root counting of kernel events

[Ingo Molnar]

* Peter Zijlstra <peterz@infradead.org> wrote:

> On Wed, 2009-02-18 at 21:26 +1100, Paul Mackerras wrote:
> > Impact: security feature
> > 
> > This allows the sysadmin to prevent non-root users from counting
> > hardware events that occur in kernel or hypervisor mode via a sysfs file:
> > 
> > 	/sys/devices/system/cpu/perf_counters/restrict_kernel_events
> > 
> > This defaults to off (0), allowing users to count kernel and hypervisor
> > events, but if the sysadmin writes 1 to that file, any new counters
> > created by non-root users will automatically be set to ignore kernel
> > and hypervisor events.
> > 
> > This could be useful if there is a concern that allowing non-root users
> > to count kernel or hypervisor events might leak sensitive information.
> 
> I would expect it the other way around, don't allow users 
> access to kernel/hv events unless explicitly granted.

i think it's useful to make userspace developers aware of the 
kernel overhead they are causing - while still allowing policy 
settings to override that default.

Maybe the name of the control should be switched around, to 
allow_kernel_events? [with the same functional end result though 
- i.e. default-enabled]

	Ingo