Skip to content
This repository has been archived by the owner on Nov 11, 2024. It is now read-only.

Revert "ANDROID: security,perf: Allow further restriction of perf_eve… #34

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Revert "ANDROID: security,perf: Allow further restriction of perf_eve… #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cfca083
powercap: restrict energy meter to root access
lenb Nov 10, 2020
2a366f1
Revert "ANDROID: security,perf: Allow further restriction of perf_eve…
JeevakaPrabu Nov 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 1 addition & 4 deletions Documentation/admin-guide/sysctl/kernel.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -721,8 +721,7 @@ perf_event_paranoid:
====================

Controls use of the performance events system by unprivileged
users (without CAP_SYS_ADMIN). The default value is 3 if
CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 2 otherwise.
users (without CAP_SYS_ADMIN). The default value is 2.

=== ==================================================================
-1 Allow use of (almost) all events by all users
Expand All @@ -736,8 +735,6 @@ CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 2 otherwise.
>=1 Disallow CPU event access by users without CAP_SYS_ADMIN

>=2 Disallow kernel profiling by users without CAP_SYS_ADMIN

>=3: Disallow all event access by users without CAP_SYS_ADMIN
=== ==================================================================


Expand Down
4 changes: 2 additions & 2 deletions drivers/powercap/powercap_sys.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,9 +367,9 @@ static void create_power_zone_common_attributes(
&dev_attr_max_energy_range_uj.attr;
if (power_zone->ops->get_energy_uj) {
if (power_zone->ops->reset_energy_uj)
dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUGO;
dev_attr_energy_uj.attr.mode = S_IWUSR | S_IRUSR;
else
dev_attr_energy_uj.attr.mode = S_IRUGO;
dev_attr_energy_uj.attr.mode = S_IRUSR;
power_zone->zone_dev_attrs[count++] =
&dev_attr_energy_uj.attr;
}
Expand Down
5 changes: 0 additions & 5 deletions include/linux/perf_event.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1241,11 +1241,6 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write,
int perf_event_max_stack_handler(struct ctl_table *table, int write,
void __user *buffer, size_t *lenp, loff_t *ppos);

static inline bool perf_paranoid_any(void)
{
return sysctl_perf_event_paranoid > 2;
}

static inline bool perf_paranoid_tracepoint_raw(void)
{
return sysctl_perf_event_paranoid > -1;
Expand Down
8 changes: 0 additions & 8 deletions kernel/events/core.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -404,13 +404,8 @@ static cpumask_var_t perf_online_mask;
* 0 - disallow raw tracepoint access for unpriv
* 1 - disallow cpu events for unpriv
* 2 - disallow kernel profiling for unpriv
* 3 - disallow all unpriv perf event use
*/
#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
int sysctl_perf_event_paranoid __read_mostly = 3;
#else
int sysctl_perf_event_paranoid __read_mostly = 2;
#endif

/* Minimum for 512 kiB + 1 user control page */
int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
Expand Down Expand Up @@ -10929,9 +10924,6 @@ int ksys_perf_event_open(struct perf_event_attr __user * attr_uptr, pid_t pid,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;

if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
return -EACCES;

err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
Expand Down
9 changes: 0 additions & 9 deletions security/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,6 @@ config SECURITY_DMESG_RESTRICT

If you are unsure how to answer this question, answer N.

config SECURITY_PERF_EVENTS_RESTRICT
bool "Restrict unprivileged use of performance events"
depends on PERF_EVENTS
help
If you say Y here, the kernel.perf_event_paranoid sysctl
will be set to 3 by default, and no unprivileged use of the
perf_event_open syscall will be permitted unless it is
changed.

config SECURITY
bool "Enable different security models"
depends on SYSFS
Expand Down