Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further restriction of perf_event_open

From	Peter Zijlstra <peterz@infradead.org>
Newsgroups	linux.kernel
Subject	Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further restriction of perf_event_open
Date	2016-10-19 18:20 +0200
Message-ID	<su02w-2rf-133@gated-at.bofh.it> (permalink)
References	<rZyjM-F9-13@gated-at.bofh.it> <stgsG-47u-7@gated-at.bofh.it> <stJuF-759-11@gated-at.bofh.it> <stJXH-7yE-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Oct 18, 2016 at 05:15:01PM -0400, Daniel Micay wrote:
> It's also worth noting that fine-grained control via a scoped mechanism
> would likely only be used to implement *more restrictions* on Android,
> not to make the feature less aggressive.

> It's desirable for perf events to be disabled by default for non-root
> across the board on Android.

Right, but this is Android. The knob seems to now also live in Debian
(and derived) distros. And there it is utter crap.

It completely defeats having perf for a fairly large segment of
corporate developers who do not get to have root on their own machines
(which is stupid policy but whatever).

It similarly defeats development of self profiling JITs and whatnot.

A capability would allow people to run perf (or another sanctioned
binary), even though in general they cannot do sys_perf_event_open().

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Mark Rutland <mark.rutland@arm.com> - 2016-10-17 15:50 +0200
  Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-10-17 17:00 +0200
    Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Mark Rutland <mark.rutland@arm.com> - 2016-10-19 16:40 +0200
      Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-10-19 17:20 +0200
  Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Kees Cook <keescook@chromium.org> - 2016-10-18 22:50 +0200
    Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-10-18 23:20 +0200
      Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Peter Zijlstra <peterz@infradead.org> - 2016-10-19 16:30 +0200
      Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Mark Rutland <mark.rutland@arm.com> - 2016-10-19 16:50 +0200
      Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Arnaldo Carvalho de Melo <acme@kernel.org> - 2016-10-19 17:20 +0200
        Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Daniel Micay <danielmicay@gmail.com> - 2016-10-19 17:40 +0200
      Re: [kernel-hardening] [PATCH 1/2] security, perf: allow further  restriction of perf_event_open Peter Zijlstra <peterz@infradead.org> - 2016-10-19 18:20 +0200

csiph-web