From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD40EC32771 for ; Sat, 18 Jan 2020 18:48:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AB2F924696 for ; Sat, 18 Jan 2020 18:48:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727111AbgARSsf (ORCPT ); Sat, 18 Jan 2020 13:48:35 -0500 Received: from mga01.intel.com ([192.55.52.88]:34927 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726502AbgARSsf (ORCPT ); Sat, 18 Jan 2020 13:48:35 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 18 Jan 2020 10:48:35 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,335,1574150400"; d="scan'208";a="227730994" Received: from linux.intel.com ([10.54.29.200]) by orsmga006.jf.intel.com with ESMTP; 18 Jan 2020 10:48:34 -0800 Received: from [10.252.10.77] (abudanko-mobl.ccr.corp.intel.com [10.252.10.77]) by linux.intel.com (Postfix) with ESMTP id 348F35803DA; Sat, 18 Jan 2020 10:48:25 -0800 (PST) Subject: Re: [PATCH v4 8/9] drivers/perf: open access for CAP_SYS_PERFMON privileged process To: Will Deacon Cc: Peter Zijlstra , Arnaldo Carvalho de Melo , Ingo Molnar , "jani.nikula@linux.intel.com" , "joonas.lahtinen@linux.intel.com" , "rodrigo.vivi@intel.com" , Alexei Starovoitov , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , "james.bottomley@hansenpartnership.com" , Serge Hallyn , James Morris , Will Deacon , Mark Rutland , Casey Schaufler , Robert Richter , Song Liu , Alexander Shishkin , Stephane Eranian , Jiri Olsa , Andi Kleen , Igor Lubashev , linux-kernel , Kees Cook , Jann Horn , linux-arm-kernel@lists.infradead.org, Namhyung Kim , Thomas Gleixner References: <20200117105153.GB6144@willie-the-truck> From: Alexey Budankov Organization: Intel Corp. Message-ID: <63e070c1-413c-efef-ccd6-97e70d8a90d0@linux.intel.com> Date: Sat, 18 Jan 2020 21:48:24 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <20200117105153.GB6144@willie-the-truck> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 17.01.2020 13:51, Will Deacon wrote: > On Wed, Dec 18, 2019 at 12:30:29PM +0300, Alexey Budankov wrote: >> >> Open access to monitoring for CAP_SYS_PERFMON privileged processes. >> For backward compatibility reasons access to the monitoring remains open >> for CAP_SYS_ADMIN privileged processes but CAP_SYS_ADMIN usage for secure >> monitoring is discouraged with respect to CAP_SYS_PERFMON capability. >> >> Signed-off-by: Alexey Budankov >> --- >> drivers/perf/arm_spe_pmu.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c >> index 4e4984a55cd1..5dff81bc3324 100644 >> --- a/drivers/perf/arm_spe_pmu.c >> +++ b/drivers/perf/arm_spe_pmu.c >> @@ -274,7 +274,7 @@ static u64 arm_spe_event_to_pmscr(struct perf_event *event) >> if (!attr->exclude_kernel) >> reg |= BIT(SYS_PMSCR_EL1_E1SPE_SHIFT); >> >> - if (IS_ENABLED(CONFIG_PID_IN_CONTEXTIDR) && capable(CAP_SYS_ADMIN)) >> + if (IS_ENABLED(CONFIG_PID_IN_CONTEXTIDR) && perfmon_capable()) >> reg |= BIT(SYS_PMSCR_EL1_CX_SHIFT); >> >> return reg; >> @@ -700,7 +700,7 @@ static int arm_spe_pmu_event_init(struct perf_event *event) >> return -EOPNOTSUPP; >> >> reg = arm_spe_event_to_pmscr(event); >> - if (!capable(CAP_SYS_ADMIN) && >> + if (!perfmon_capable() && >> (reg & (BIT(SYS_PMSCR_EL1_PA_SHIFT) | >> BIT(SYS_PMSCR_EL1_CX_SHIFT) | >> BIT(SYS_PMSCR_EL1_PCT_SHIFT)))) > > Acked-by: Will Deacon > > Worth noting that this allows profiling of *physical* addresses used by > memory access instructions and so probably has some security implications > beyond the usual "but perf is buggy" line of reasoning. Good to know. Thank you! The data on physical addresses used by memory access instructions can already be provided under CAP_SYS_ADMIN privileges [1] thus, I suppose, any implications you have mentioned are already in place. I believe providing the data under CAP_PERFMON alone without the rest of CAP_SYS_ADMIN credentials decreases chances to misuse the data for harm and makes the monitoring more secure. ~Alexey [1] https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html > > Will >