Document and extend kernel.perf_event_paranoid
Subsystems (3)
cover Document and extend kernel.perf_event_paranoid
This moves documentation for the kernel.perf_event_paranoid to the Documentation directory, then adds a more paranoid level.
Ben.
Ben Hutchings (2):
Documentation,perf: Document the perf sysctls security,perf: Allow further restriction of perf_event_open
Documentation/sysctl/kernel.txt | 15 +++++++++++++++ include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ tools/perf/util/evsel.c | 7 ++----- 5 files changed, 39 insertions(+), 5 deletions(-)
PATCH 1/2 Documentation,perf: Document the perf sysctls
perf_event_paranoid was only documented in source code and a perf error message. Move the documentation from the error message to Documentation/sysctl/kernel.txt.
perf_cpu_time_max_percent was already documented but missing from the list at the top, so add it there.
--- Documentation/sysctl/kernel.txt | 13 +++++++++++++ tools/perf/util/evsel.c | 7 ++----- 2 files changed, 15 insertions(+), 5 deletions(-)
Documentation/sysctl/kernel.txt +13 -0
@@ -58,6 +58,8 @@ show up in /proc/sys/kernel: - panic_on_stackoverflow - panic_on_unrecovered_nmi - panic_on_warn +- perf_cpu_time_max_percent +- perf_event_paranoid - pid_max - powersave-nap [ PPC only ] - printk
@@ -624,6 +626,17 @@ allowed to execute. ============================================================== +perf_event_paranoid: + +Controls use of the performance events system by unprivileged +users (without CAP_SYS_ADMIN). The default value is 1. + + -1: Allow use of (almost) all events by all users +>=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK +>=1: Disallow CPU event access by users without CAP_SYS_ADMIN +>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN + +============================================================== pid_max:
tools/perf/util/evsel.c +2 -5
@@ -2314,11 +2314,8 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,case EACCES :return scnprintf (msg, size,"You may not have permission to collect %sstats.\n" -"Consider tweaking /proc/sys/kernel/perf_event_paranoid:\n" -" -1 - Not paranoid at all\n" -" 0 - Disallow raw tracepoint access for unpriv\n" -" 1 - Disallow cpu events for unpriv\n" -" 2 - Disallow kernel profiling for unpriv" , +"Consider tweaking /proc/sys/kernel/perf_event_paranoid -\n" +"see Documentation/sysctl/kernel.txt" , target->system_wide ?"system-wide " :"" );case ENOENT : return scnprintf(msg, size, "The %s event is not supported.",
PATCH 2/2 security,perf: Allow further restriction of perf_event_open
In reply to Ben HutchingsWhen kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without CAP_SYS_ADMIN. Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that makes this value the default.
This is based on a similar feature in grsecurity (CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.
---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.
Ben.
Documentation/sysctl/kernel.txt | 4 +++- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-)
Documentation/sysctl/kernel.txt +3 -1
@@ -629,12 +629,14 @@ allowed to execute. perf_event_paranoid: Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 1. +users (without CAP_SYS_ADMIN). The default value is 3 if +CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 1 otherwise. -1: Allow use of (almost) all events by all users >=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >=1: Disallow CPU event access by users without CAP_SYS_ADMIN >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN +>=3: Disallow all event access by users without CAP_SYS_ADMIN ==============================================================
include/linux/perf_event.h +5 -0
@@ -989,6 +989,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, loff_t *ppos); +static inline bool perf_paranoid_any (void ) +{ +return sysctl_perf_event_paranoid >2 ; +} +static inline bool perf_paranoid_tracepoint_raw (void ) {return sysctl_perf_event_paranoid >-1 ;
kernel/events/core.c +8 -0
@@ -175,8 +175,13 @@ static struct srcu_struct pmus_srcu;* 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv +* 3 - disallow all unpriv perf event use */ +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT +int sysctl_perf_event_paranoid__read_mostly =3 ; +#else int sysctl_perf_event_paranoid__read_mostly =1 ; +#endif /* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock__read_mostly =512 + (PAGE_SIZE /1024 );/* 'free' kiB per user */
@@ -8265,6 +8270,9 @@ SYSCALL_DEFINE5(perf_event_open,if (flags & ~PERF_FLAG_ALL )return -EINVAL ; +if (perf_paranoid_any () && !capable (CAP_SYS_ADMIN )) +return -EACCES ; + err =perf_copy_attr (attr_uptr, &attr);if (err)return err;
security/Kconfig +9 -0
@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_PERF_EVENTS_RESTRICT + bool "Restrict unprivileged use of performance events" + depends on PERF_EVENTS + help + If you say Y here, the kernel.perf_event_paranoid sysctl + will be set to 3 by default, and no unprivileged use of the + perf_event_open syscall will be permitted unless it is + changed. + config SECURITY bool "Enable different security models" depends on SYSFS
Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Quoted 11 lines · Ben Hutchings
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.Signed-off-by Ben Hutchings <[email protected]>
Whoops, I entirely missed this email! Just found it now.
Ben, can you resend this with Perf maintainers in CC? This seems sensible enough to me.
-Kees
Quoted 96 lines
---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.Ben.
Documentation/sysctl/kernel.txt | 4 +++- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-)Documentation/sysctl/kernel.txt +3
-1@@ -629,12 +629,14 @@ allowed to execute. perf_event_paranoid: Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 1. +users (without CAP_SYS_ADMIN). The default value is 3 if +CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 1 otherwise. -1: Allow use of (almost) all events by all users >=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >=1: Disallow CPU event access by users without CAP_SYS_ADMIN >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN +>=3: Disallow all event access by users without CAP_SYS_ADMIN ==============================================================include/linux/perf_event.h +5
-0@@ -989,6 +989,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, loff_t *ppos); +static inline bool perf_paranoid_any (void ) +{ +return sysctl_perf_event_paranoid >2 ; +} +static inline bool perf_paranoid_tracepoint_raw (void ) {return sysctl_perf_event_paranoid >-1 ;kernel/events/core.c +8
-0@@ -175,8 +175,13 @@ static struct srcu_struct pmus_srcu;* 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv +* 3 - disallow all unpriv perf event use */ +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT +int sysctl_perf_event_paranoid__read_mostly =3 ; +#else int sysctl_perf_event_paranoid__read_mostly =1 ; +#endif /* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock__read_mostly =512 + (PAGE_SIZE /1024 );/* 'free' kiB per user */ @@ -8265,6 +8270,9 @@ SYSCALL_DEFINE5(perf_event_open,if (flags & ~PERF_FLAG_ALL )return -EINVAL ; +if (perf_paranoid_any () && !capable (CAP_SYS_ADMIN )) +return -EACCES ; + err =perf_copy_attr (attr_uptr, &attr);if (err)return err;security/Kconfig +9
-0@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_PERF_EVENTS_RESTRICT + bool "Restrict unprivileged use of performance events" + depends on PERF_EVENTS + help + If you say Y here, the kernel.perf_event_paranoid sysctl + will be set to 3 by default, and no unprivileged use of the + perf_event_open syscall will be permitted unless it is + changed. + config SECURITY bool "Enable different security models" depends on SYSFS
Signature · 2 lines
Kees Cook Chrome OS & Brillo Security
Jeffrey Vander Stoep
Acked-byRe: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
In addition to Debian, this patch has been merged into AOSP and is a requirement for Android:
https://android-review.googlesource.com/#/q/topic:CONFIG_SECURITY_PERF_EVENTS_RESTRICT
Quoted 1 line · Kees Cook
On Mon, Jan 11, 2016 at 7:23 AM, Ben Hutchings <[email protected]>
Quoted 25 lines · wrote:
Quoted 11 lines
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.Signed-off-by Ben Hutchings <[email protected]>Whoops, I entirely missed this email! Just found it now.
Ben, can you resend this with Perf maintainers in CC? This seems sensible enough to me.
-Kees
Quoted 6 lines
---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.Ben.
Quoted 7 lines
Review
Quoted 7 lines
Documentation/sysctl/kernel.txt | 4 +++- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-)(quoted diff) +0
-0
b/Documentation/sysctl/kernel.txt
Quoted 17 lines
Quoted 17 lines
index 88a2c8e..76e2ca8 100644
Documentation/sysctl/kernel.txt +3
-1@@ -629,12 +629,14 @@ allowed to execute. perf_event_paranoid: Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 1. +users (without CAP_SYS_ADMIN). The default value is 3 if +CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 1 otherwise. -1: Allow use of (almost) all events by all users >=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >=1: Disallow CPU event access by users without CAP_SYS_ADMIN >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN +>=3: Disallow all event access by users without CAP_SYS_ADMIN
Quoted 7 lines
include/linux/perf_event.h extern int perf_cpu_time_max_percent_handler(struct
Quoted 7 lines
Documentation/sysctl/kernel.txt +0
-0==============================================================include/linux/perf_event.h +0
-0@@ -989,6 +989,11 @@ extern int perf_cpu_time_max_percent_handler(struct
ctl_table *table, int write,
Quoted 27 lines
Quoted 27 lines
include/linux/perf_event.h +5
-0loff_t *ppos); +static inline bool perf_paranoid_any (void ) +{ +return sysctl_perf_event_paranoid >2 ; +} +static inline bool perf_paranoid_tracepoint_raw (void ) {return sysctl_perf_event_paranoid >-1 ;kernel/events/core.c +5
-0@@ -175,8 +175,13 @@ static struct srcu_struct pmus_srcu;* 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv +* 3 - disallow all unpriv perf event use */ +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT +int sysctl_perf_event_paranoid__read_mostly =3 ; +#else int sysctl_perf_event_paranoid__read_mostly =1 ; +#endif
Quoted 2 lines
kernel/events/core.c static struct srcu_struct pmus_srcu; · line 187
Quoted 2 lines
kernel/events/core.c +0
-0/* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock__read_mostly =512 + (PAGE_SIZE /1024 );
/* 'free' kiB per user */
Quoted 36 lines
Quoted 20 lines
kernel/events/core.c +3
-0@@ -8265,6 +8270,9 @@ SYSCALL_DEFINE5(perf_event_open,if (flags & ~PERF_FLAG_ALL )return -EINVAL ; +if (perf_paranoid_any () && !capable (CAP_SYS_ADMIN )) +return -EACCES ; + err =perf_copy_attr (attr_uptr, &attr);if (err)return err;security/Kconfig +2
-0@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_PERF_EVENTS_RESTRICT + bool "Restrict unprivileged use of performance events"security/Kconfig config SECURITY_DMESG_RESTRICT · line 32
Quoted 10 lines
security/Kconfig +7
-0+ depends on PERF_EVENTS + help + If you say Y here, the kernel.perf_event_paranoid sysctl + will be set to 3 by default, and no unprivileged use of the + perf_event_open syscall will be permitted unless it is + changed. + config SECURITY bool "Enable different security models" depends on SYSFS--
Kees Cook
Chrome OS & Brillo Security
Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Hi guys,
This patch wasn't originally CCed to you (I'm fixing that now). Would you consider taking this into the perf tree? It's been in active use in both Debian and Android for a while now.
(If need be, I can resend it.)
Thanks!
-Kees
Quoted 135 lines · Jeffrey Vander Stoep
In addition to Debian, this patch has been merged into AOSP and is a requirement for Android:
https://android-review.googlesource.com/#/q/topic:CONFIG_SECURITY_PERF_EVENTS_RESTRICTQuoted 126 lines · Kees Cook
Quoted 11 lines · Ben Hutchings
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.Signed-off-by Ben Hutchings <[email protected]>Whoops, I entirely missed this email! Just found it now.
Ben, can you resend this with Perf maintainers in CC? This seems sensible enough to me.
-Kees
Quoted 89 lines
---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.Ben.
Documentation/sysctl/kernel.txt | 4 +++- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-)Documentation/sysctl/kernel.txt +3
-1@@ -629,12 +629,14 @@ allowed to execute. perf_event_paranoid: Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 1. +users (without CAP_SYS_ADMIN). The default value is 3 if +CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 1 otherwise. -1: Allow use of (almost) all events by all users >=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >=1: Disallow CPU event access by users without CAP_SYS_ADMIN >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN +>=3: Disallow all event access by users without CAP_SYS_ADMIN ==============================================================include/linux/perf_event.h +5
-0@@ -989,6 +989,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, loff_t *ppos); +static inline bool perf_paranoid_any (void ) +{ +return sysctl_perf_event_paranoid >2 ; +} +static inline bool perf_paranoid_tracepoint_raw (void ) {return sysctl_perf_event_paranoid > -1;kernel/events/core.c +5
-0@@ -175,8 +175,13 @@ static struct srcu_struct pmus_srcu;* 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv +* 3 - disallow all unpriv perf event use */ +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT +int sysctl_perf_event_paranoid__read_mostly =3 ; +#else int sysctl_perf_event_paranoid__read_mostly =1 ; +#endif /* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock__read_mostly =512 + (PAGE_SIZE /1024 );/* 'free' kiB per user */
kernel/events/core.c +3
-0@@ -8265,6 +8270,9 @@ SYSCALL_DEFINE5(perf_event_open,if (flags & ~PERF_FLAG_ALL )return -EINVAL ; +if (perf_paranoid_any () && !capable (CAP_SYS_ADMIN )) +return -EACCES ; + err =perf_copy_attr (attr_uptr, &attr);if (err)return err;security/Kconfig +2
-0@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_PERF_EVENTS_RESTRICT + bool "Restrict unprivileged use of performance events"security/Kconfig config SECURITY_DMESG_RESTRICT · line 32
Quoted 10 lines
security/Kconfig +7
-0+ depends on PERF_EVENTS + help + If you say Y here, the kernel.perf_event_paranoid sysctl + will be set to 3 by default, and no unprivileged use of the + perf_event_open syscall will be permitted unless it is + changed. + config SECURITY bool "Enable different security models" depends on SYSFS--
Kees Cook
Chrome OS & Brillo Security
Signature · 2 lines
Kees Cook Chrome OS & Brillo Security
Peter Zijlstra
maintainerRe: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Quoted 4 lines · Kees Cook
Hi guys,
This patch wasn't originally CCed to you (I'm fixing that now). Would you consider taking this into the perf tree?
No.
Quoted 2 lines
It's been in active use
in both Debian and Android for a while now.
Very nice of you all to finally inform us I suppose :/
Quoted 9 lines
Quoted 9 lines
Quoted 9 lines
Quoted 9 lines
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.
This Changelog is completely devoid of information. _WHY_ are you doing this?
Also, hate the CONFIG.
Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Quoted 7 lines · Peter Zijlstra
Quoted 5 lines · Kees Cook
Hi guys,
This patch wasn't originally CCed to you (I'm fixing that now). Would
you consider taking this into the perf tree?
Quoted 6 lines
No.
Quoted 2 lines
It's been in active use
in both Debian and Android for a while now.Very nice of you all to finally inform us I suppose :/
It was in Debian a lot longer than Android, although the Android feature came from a downstream variant where it was done much earlier:
https://android-review.googlesource.com/#/c/233736/
Quoted 12 lines
Quoted 11 lines
Quoted 11 lines
Quoted 11 lines
Quoted 11 lines
access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
the variable read-only. It also allows enabling further restriction
at run-time regardless of whether the default is changed.
Quoted 3 lines
This Changelog is completely devoid of information. _WHY_ are you doing
this?
Attack surface reduction. It's possible to use seccomp-bpf for some limited cases, but it's not flexible enough. There are lots of information leaks and local privilege escalation vulnerabilities via perf events, yet on most Linux installs it's not ever being used. So turning it off by default on those installs is an easy win. The holes are reduced to root -> kernel (and that's not a meaningful boundary in mainline right now - although as is the case here, Debian has a bunch of securelevel patches for that).
Arnaldo Carvalho de Melo
maintainerRe: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Em Fri, Jun 17, 2016 at 12:16:47PM -0400, Daniel Micay escreveu:
Quoted 12 lines · Peter Zijlstra
Quoted 2 lines
This Changelog is completely devoid of information. _WHY_ are you doing this?
Attack surface reduction. It's possible to use seccomp-bpf for some limited cases, but it's not flexible enough. There are lots of information leaks and local privilege escalation vulnerabilities via perf events, yet on most Linux installs it's not ever being used. So turning it off by default on those installs is an easy win. The holes are reduced to root -> kernel (and that's not a meaningful boundary in mainline right now - although as is the case here, Debian has a bunch of securelevel patches for that).
Is ptrace also disabled on such systems, or any of the other more recent syscalls? The same arguments could probably be used to disable those:
reduce attack surface, possibly the new ones have bugs as they are relatively new and it takes a long time for new syscalls to be more generally used, if we go on disabling them in such a way, they will probably never get used :-\
Wouldn't the recent bump in perf_event_paranoid to 2 enough? I.e. only allow profiling of user tasks?
Or is there something more specific that we should disable/constrain to reduce such surface contact without using such a big hammer?
- Arnaldo
Re: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Quoted 17 lines · Arnaldo Carvalho de Melo
Em Fri, Jun 17, 2016 at 12:16:47PM -0400, Daniel Micay escreveu:
Quoted 3 lines · Peter Zijlstra
Quoted 2 lines
This Changelog is completely devoid of information. _WHY_ are you doing this?
Quoted 11 lines
Attack surface reduction. It's possible to use seccomp-bpf for some limited cases, but it's not flexible enough. There are lots of information leaks and local privilege escalation vulnerabilities via perf events, yet on most Linux installs it's not ever being used. So turning it off by default on those installs is an easy win. The holes
are reduced to root -> kernel (and that's not a meaningful boundary in
mainline right now - although as is the case here, Debian has a bunch of
securelevel patches for that).
Quoted 7 lines
Is ptrace also disabled on such systems, or any of the other more recent
syscalls? The same arguments could probably be used to disable those:
reduce attack surface, possibly the new ones have bugs as they are relatively new and it takes a long time for new syscalls to be more generally used, if we go on disabling them in such a way, they will probably never get used :-\
ptrace is allowed for third party apps within their SELinux domain, but they all run as different users (so the kernel attack surface is there). It's now disabled for privileged platform apps and most other domains. A bit backwards, but removing it for third party apps would break compatibility so it would have to be done at an API level bump. At least, without deciding it is worth the cost like hidepid=2 in Android N (which exposes no mechanism for exceptions in 3rd party apps, only the base system).
If seccomp-bpf didn't imply such high system call overhead outside of x86_64, Android would probably be walling off some new system calls. It needs 2-phase lookup similar to x86 on ARM. Android kernels do avoid enabling lots of kernel functionality from System V IPC to USERNS though. New features wouldn't end up enabled if they were behind config options without an explicit choice.
Quoted 2 lines
Wouldn't the recent bump in
perf_event_paranoidto 2 enough? I.e. only allow profiling of user tasks?
Most of the vulnerabilities are still exposed at 2. That prevents leaking information about the kernel WITHOUT vulnerabilities though, and would be an improvement when perf is disabled - but that doesn't really matter much (Android kernel debugging and profiling would also still work with 2).
Quoted 3 lines
Or is there something more specific that we should disable/constrain to
reduce such surface contact without using such a big hammer?
It's desired to have it globally disabled by default. Could use seccomp- bpf to globally disable it, but that's a bigger hammer because it can't be globally turned off without a reboot (could only profile newly spawned processes after disabling it). Since it's only going to be enabled by developers, trying to make it more fine-grained wouldn't really pay off.
Jeffrey Vander Stoep
Acked-byRe: [kernel-hardening] [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
In reply to Kees CookIn addition to Debian, this patch has been merged into AOSP and is a requirement for Android:
https://android-review.googlesource.com/#/q/topic:CONFIG_SECURITY_PERF_EVENTS_RESTRICT
Quoted 122 lines · Kees Cook
Quoted 11 lines · Ben Hutchings
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.Signed-off-by Ben Hutchings <[email protected]>Whoops, I entirely missed this email! Just found it now.
Ben, can you resend this with Perf maintainers in CC? This seems sensible enough to me.
-Kees
Quoted 86 lines
---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.Ben.
Documentation/sysctl/kernel.txt | 4 +++- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 8 ++++++++ security/Kconfig | 9 +++++++++ 4 files changed, 25 insertions(+), 1 deletion(-)Documentation/sysctl/kernel.txt +3
-1@@ -629,12 +629,14 @@ allowed to execute. perf_event_paranoid: Controls use of the performance events system by unprivileged -users (without CAP_SYS_ADMIN). The default value is 1. +users (without CAP_SYS_ADMIN). The default value is 3 if +CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 1 otherwise. -1: Allow use of (almost) all events by all users >=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK >=1: Disallow CPU event access by users without CAP_SYS_ADMIN >=2: Disallow kernel profiling by users without CAP_SYS_ADMIN +>=3: Disallow all event access by users without CAP_SYS_ADMIN ==============================================================include/linux/perf_event.h +5
-0@@ -989,6 +989,11 @@ extern int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, loff_t *ppos); +static inline bool perf_paranoid_any (void ) +{ +return sysctl_perf_event_paranoid >2 ; +} +static inline bool perf_paranoid_tracepoint_raw (void ) {return sysctl_perf_event_paranoid >-1 ;kernel/events/core.c +8
-0@@ -175,8 +175,13 @@ static struct srcu_struct pmus_srcu;* 0 - disallow raw tracepoint access for unpriv * 1 - disallow cpu events for unpriv * 2 - disallow kernel profiling for unpriv +* 3 - disallow all unpriv perf event use */ +#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT +int sysctl_perf_event_paranoid__read_mostly =3 ; +#else int sysctl_perf_event_paranoid__read_mostly =1 ; +#endif /* Minimum for 512 kiB + 1 user control page */ int sysctl_perf_event_mlock__read_mostly =512 + (PAGE_SIZE /1024 );/* 'free' kiB per user */ @@ -8265,6 +8270,9 @@ SYSCALL_DEFINE5(perf_event_open,if (flags & ~PERF_FLAG_ALL )return -EINVAL ; +if (perf_paranoid_any () && !capable (CAP_SYS_ADMIN )) +return -EACCES ; + err =perf_copy_attr (attr_uptr, &attr);if (err)return err;security/Kconfig +2
-0@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT If you are unsure how to answer this question, answer N. +config SECURITY_PERF_EVENTS_RESTRICT + bool "Restrict unprivileged use of performance events"security/Kconfig config SECURITY_DMESG_RESTRICT · line 32
Quoted 10 lines
security/Kconfig +7
-0+ depends on PERF_EVENTS + help + If you say Y here, the kernel.perf_event_paranoid sysctl + will be set to 3 by default, and no unprivileged use of the + perf_event_open syscall will be permitted unless it is + changed. + config SECURITY bool "Enable different security models" depends on SYSFS--
Kees Cook
Chrome OS & Brillo Security
Alexander Shishkin
reviewerRe: [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
In reply to Ben HutchingsQuoted 4 lines · Ben Hutchings
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.
So this patch does two things, can it then be made into two patches?
Quoted 5 lines
This is based on a similar feature in grsecurity (
CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.
This paragraph doesn't seem to belong in the commit message.
What this commit message is missing entirely is the rationale behind this change other than "grsecurity does the same". Can you please elaborate?
Quoted 4 lines
Signed-off-by Ben Hutchings <[email protected]>---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.
As a debian user, is this a good place to complain? Because it does get it the way.
Thanks,
--
Alex
Re: [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
Quoted 8 lines · Alexander Shishkin
Quoted 4 lines · Ben Hutchings
When kernel.perf_event_open is set to 3 (or greater), disallow all access to performance events by users without
CAP_SYS_ADMIN. Add aKconfigsymbolCONFIG_SECURITY_PERF_EVENTS_RESTRICTthat makes this value the default.So this patch does two things, can it then be made into two patches?
It could.
Quoted 7 lines
Quoted 5 lines
This is based on a similar feature in grsecurity (CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making the variable read-only. It also allows enabling further restriction at run-time regardless of whether the default is changed.
This paragraph doesn't seem to belong in the commit message.
I'm giving credit where credit is due.
Quoted 3 lines
What this commit message is missing entirely is the rationale behind this change other than "grsecurity does the same". Can you please elaborate?
It allows disabling a facility which in many systems is not needed and is only a security risk.
Quoted 7 lines
Quoted 4 lines
Signed-off-by Ben Hutchings <[email protected]>---
I made a similar change to Debian's kernel packages in August, including the more restrictive default, and no-one has complained yet.As a debian user, is this a good place to complain? Because it does get it the way.
OK, then you're the first one. And you know how to change this, don't you?
Ben.
Signature · 4 lines
Ben Hutchings We get into the habit of living before acquiring the habit of thinking. - Albert Camus
Re: [kernel-hardening] Re: [PATCH 2/2] security,perf: Allow further restriction of perf_event_open
In reply to Alexander ShishkinQuoted 3 lines
As a debian user, is this a good place to complain? Because it does get
it the way.
It would be relevant to whether or not it should be set to 3 by default in the kernel without explicit configuration, but there's no proposal to do that. Debian has to pick a trade-off beyond security and a tiny roadblock for developers. It's not always the case though.
In Android, there's userspace integration allowing it to be toggled by the Android Debugging Bridge shell user so profiling tools are being taught to automatically toggle it. Enabling ADB and then using it for profiling is an implicit opt-in.
PATCH RESEND 1/1 perf: Document the perf sysctls
In reply to Ben Hutchingsperf_event_paranoid was only documented in source code and a perf error message. Move the documentation from the error message to Documentation/sysctl/kernel.txt.
perf_cpu_time_max_percent was already documented but missing from the list at the top, so add it there.
--- Documentation/sysctl/kernel.txt | 13 +++++++++++++ tools/perf/util/evsel.c | 7 ++----- 2 files changed, 15 insertions(+), 5 deletions(-)
Documentation/sysctl/kernel.txt +13 -0
@@ -58,6 +58,8 @@ show up in /proc/sys/kernel: - panic_on_stackoverflow - panic_on_unrecovered_nmi - panic_on_warn +- perf_cpu_time_max_percent +- perf_event_paranoid - pid_max - powersave-nap [ PPC only ] - printk
@@ -624,6 +626,17 @@ allowed to execute. ============================================================== +perf_event_paranoid: + +Controls use of the performance events system by unprivileged +users (without CAP_SYS_ADMIN). The default value is 1. + + -1: Allow use of (almost) all events by all users +>=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK +>=1: Disallow CPU event access by users without CAP_SYS_ADMIN +>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN + +============================================================== pid_max:
tools/perf/util/evsel.c +2 -5
@@ -2314,11 +2314,8 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,case EACCES :return scnprintf (msg, size,"You may not have permission to collect %sstats.\n" -"Consider tweaking /proc/sys/kernel/perf_event_paranoid:\n" -" -1 - Not paranoid at all\n" -" 0 - Disallow raw tracepoint access for unpriv\n" -" 1 - Disallow cpu events for unpriv\n" -" 2 - Disallow kernel profiling for unpriv" , +"Consider tweaking /proc/sys/kernel/perf_event_paranoid -\n" +"see Documentation/sysctl/kernel.txt" , target->system_wide ?"system-wide " :"" );case ENOENT : return scnprintf(msg, size, "The %s event is not supported.",
Arnaldo Carvalho de Melo
maintainerRe: [PATCH RESEND] perf: Document the perf sysctls
Em Tue, Jan 19, 2016 at 09:35:15PM +0000, Ben Hutchings escreveu:
Quoted 50 lines
perf_event_paranoidwas only documented in source code and a perf error message. Move the documentation from the error message toDocumentation/sysctl/kernel.txt.
perf_cpu_time_max_percentwas already documented but missing from the list at the top, so add it there.Signed-off-by Ben Hutchings <[email protected]>--- Documentation/sysctl/kernel.txt | 13 +++++++++++++ tools/perf/util/evsel.c | 7 ++----- 2 files changed, 15 insertions(+), 5 deletions(-)Documentation/sysctl/kernel.txt +13
-0@@ -58,6 +58,8 @@ show up in /proc/sys/kernel: - panic_on_stackoverflow - panic_on_unrecovered_nmi - panic_on_warn +- perf_cpu_time_max_percent +- perf_event_paranoid - pid_max - powersave-nap [ PPC only ] - printk@@ -624,6 +626,17 @@ allowed to execute. ============================================================== +perf_event_paranoid: + +Controls use of the performance events system by unprivileged +users (without CAP_SYS_ADMIN). The default value is 1. + + -1: Allow use of (almost) all events by all users +>=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK +>=1: Disallow CPU event access by users without CAP_SYS_ADMIN +>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN + +============================================================== pid_max:tools/perf/util/evsel.c +0
-0@@ -2314,11 +2314,8 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,case EACCES :
tools/perf/util/evsel.c int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target, · line 2319
Quoted 10 lines
tools/perf/util/evsel.c +2
-5return scnprintf (msg, size,"You may not have permission to collect %sstats.\n" -"Consider tweaking /proc/sys/kernel/perf_event_paranoid:\n" -" -1 - Not paranoid at all\n" -" 0 - Disallow raw tracepoint access for unpriv\n" -" 1 - Disallow cpu events for unpriv\n" -" 2 - Disallow kernel profiling for unpriv" , +"Consider tweaking /proc/sys/kernel/perf_event_paranoid -\n" +"see Documentation/sysctl/kernel.txt" , target->system_wide ?"system-wide " :"" );
Don't remove readily available information by a reference to a not always available file, I'm just synching this with the doc text you added to that Documentation file.
- Arnaldo
Quoted 3 lines
tools/perf/util/evsel.c +0
-0case ENOENT : return scnprintf(msg, size, "The %s event is not supported.",
tip-bot for Ben Hutchings
merge bot[tip:perf/core] perf tools: Document the perf sysctls
In reply to Ben Hutchingsperf tools: Document the perf sysctls
Commit-ID: 3379e0c3effa87d7734fc06277a7023292aadb0c Gitweb: http://git.kernel.org/tip/3379e0c3effa87d7734fc06277a7023292aadb0c Author: Ben Hutchings <[email protected]> AuthorDate: Tue, 19 Jan 2016 21:35:15 +0000 Committer: Arnaldo Carvalho de Melo <[email protected]> CommitDate: Tue, 26 Jan 2016 11:52:45 -0300
perf tools: Document the perf sysctls
perf_event_paranoid was only documented in source code and a perf error message. Copy the documentation from the error message to Documentation/sysctl/kernel.txt.
perf_cpu_time_max_percent was already documented but missing from the list at the top, so add it there.
--- Documentation/sysctl/kernel.txt | 13 +++++++++++++ tools/perf/util/evsel.c | 15 +++++++++------ 2 files changed, 22 insertions(+), 6 deletions(-)
Documentation/sysctl/kernel.txt +13 -0
@@ -58,6 +58,8 @@ show up in /proc/sys/kernel: - panic_on_stackoverflow - panic_on_unrecovered_nmi - panic_on_warn +- perf_cpu_time_max_percent +- perf_event_paranoid - pid_max - powersave-nap [ PPC only ] - printk
@@ -639,6 +641,17 @@ allowed to execute. ============================================================== +perf_event_paranoid: + +Controls use of the performance events system by unprivileged +users (without CAP_SYS_ADMIN). The default value is 1. + + -1: Allow use of (almost) all events by all users +>=0: Disallow raw tracepoint access by users without CAP_IOC_LOCK +>=1: Disallow CPU event access by users without CAP_SYS_ADMIN +>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN + +============================================================== pid_max:
tools/perf/util/evsel.c +9 -6
@@ -2362,12 +2362,15 @@ int perf_evsel__open_strerror(struct perf_evsel *evsel, struct target *target,case EPERM :case EACCES :return scnprintf (msg, size, -"You may not have permission to collect %sstats.\n" -"Consider tweaking /proc/sys/kernel/perf_event_paranoid:\n" -" -1 - Not paranoid at all\n" -" 0 - Disallow raw tracepoint access for unpriv\n" -" 1 - Disallow cpu events for unpriv\n" -" 2 - Disallow kernel profiling for unpriv" , +"You may not have permission to collect %sstats.\n\n" +"Consider tweaking /proc/sys/kernel/perf_event_paranoid,\n" +"which controls use of the performance events system by\n" +"unprivileged users (without CAP_SYS_ADMIN).\n\n" +"The default value is 1:\n\n" +" -1: Allow use of (almost) all events by all users\n" +">= 0: Disallow raw tracepoint access by users without CAP_IOC_LOCK\n" +">= 1: Disallow CPU event access by users without CAP_SYS_ADMIN\n" +">= 2: Disallow kernel profiling by users without CAP_SYS_ADMIN" , target->system_wide ?"system-wide " :"" );case ENOENT : return scnprintf(msg, size, "The %s event is not supported.",