Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open

From	Peter Zijlstra <peterz@infradead.org>
Newsgroups	linux.kernel
Subject	Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Date	2016-06-17 09:00 +0200
Message-ID	<rKVUZ-372-7@gated-at.bofh.it> (permalink)
References	<qPMzU-4ae-19@gated-at.bofh.it> <qPMzU-4ae-17@gated-at.bofh.it> <rnvGh-3Tg-9@gated-at.bofh.it> <rKNXs-5C7-23@gated-at.bofh.it> <rKNXs-5C7-21@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Jun 16, 2016 at 03:27:55PM -0700, Kees Cook wrote:
> Hi guys,
> 
> This patch wasn't originally CCed to you (I'm fixing that now). Would
> you consider taking this into the perf tree? 

No.

> It's been in active use
> in both Debian and Android for a while now.

Very nice of you all to finally inform us I suppose :/

> >>> When kernel.perf_event_open is set to 3 (or greater), disallow all
> >>> access to performance events by users without CAP_SYS_ADMIN.
> >>> Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
> >>> makes this value the default.
> >>>
> >>> This is based on a similar feature in grsecurity
> >>> (CONFIG_GRKERNSEC_PERF_HARDEN).  This version doesn't include making
> >>> the variable read-only.  It also allows enabling further restriction
> >>> at run-time regardless of whether the default is changed.

This Changelog is completely devoid of information. _WHY_ are you doing
this?

Also, hate the CONFIG.

Thread

Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further  restriction of perf_event_open Kees Cook <keescook@chromium.org> - 2016-06-17 00:30 +0200
  Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further  restriction of perf_event_open Peter Zijlstra <peterz@infradead.org> - 2016-06-17 09:00 +0200
    Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-06-17 18:20 +0200
      Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further  restriction of perf_event_open Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-06-17 22:10 +0200
        Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-06-18 03:00 +0200

csiph-web