)]}' { "commit": "b240ea2fe1f1c2384fbd5ea8d269ae34c859ef29", "tree": "f6064c958d98ed61efc9936d3b04ca5c09ca9d04", "parents": [ "43149c67d9eab8c02ce6958ec7867caba58b0af8" ], "author": { "name": "Joel Fernandes (Google)", "email": "joel@joelfernandes.org", "time": "Mon Oct 14 13:03:08 2019 -0400" }, "committer": { "name": "Roy Yang", "email": "royyang@google.com", "time": "Fri Jul 17 01:45:51 2020 +0000" }, "message": "perf_event: Add support for LSM and SELinux checks\n\nIn current mainline, the degree of access to perf_event_open(2) system\ncall depends on the perf_event_paranoid sysctl. This has a number of\nlimitations:\n\n1. The sysctl is only a single value. Many types of accesses are controlled\n based on the single value thus making the control very limited and\n coarse grained.\n2. The sysctl is global, so if the sysctl is changed, then that means\n all processes get access to perf_event_open(2) opening the door to\n security issues.\n\nThis patch adds LSM and SELinux access checking which will be used in\nAndroid to access perf_event_open(2) for the purposes of attaching BPF\nprograms to tracepoints, perf profiling and other operations from\nuserspace. These operations are intended for production systems.\n\n5 new LSM hooks are added:\n1. perf_event_open: This controls access during the perf_event_open(2)\n syscall itself. The hook is called from all the places that the\n perf_event_paranoid sysctl is checked to keep it consistent with the\n systctl. The hook gets passed a \u0027type\u0027 argument which controls CPU,\n kernel and tracepoint accesses (in this context, CPU, kernel and\n tracepoint have the same semantics as the perf_event_paranoid sysctl).\n Additionally, I added an \u0027open\u0027 type which is similar to\n perf_event_paranoid sysctl \u003d\u003d 3 patch carried in Android and several other\n distros but was rejected in mainline [1] in 2016.\n\n2. perf_event_alloc: This allocates a new security object for the event\n which stores the current SID within the event. It will be useful when\n the perf event\u0027s FD is passed through IPC to another process which may\n try to read the FD. Appropriate security checks will limit access.\n\n3. perf_event_free: Called when the event is closed.\n\n4. perf_event_read: Called from the read(2) and mmap(2) syscalls for the event.\n\n5. perf_event_write: Called from the ioctl(2) syscalls for the event.\n\n[1] https://lwn.net/Articles/696240/\n\nSince Peter had suggest LSM hooks in 2016 [1], I am adding his\nSuggested-by tag below.\n\nTo use this patch, we set the perf_event_paranoid sysctl to -1 and then\napply selinux checking as appropriate (default deny everything, and then\nadd policy rules to give access to domains that need it). In the future\nwe can remove the perf_event_paranoid sysctl altogether.\n\nBUG\u003db/149273109\nTEST\u003dtryjob\nRELEASE_NOTE\u003dBackport \"perf_event: Add support for LSM and SELinux\nchecks\"\nSOURCE\u003dUPSTREAM(da97e18458fb42d7c00fac5fd1c56a3896ec666e)\n\nSuggested-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCo-developed-by: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nSigned-off-by: Joel Fernandes (Google) \u003cjoel@joelfernandes.org\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nAcked-by: James Morris \u003cjmorris@namei.org\u003e\nCc: Arnaldo Carvalho de Melo \u003cacme@kernel.org\u003e\nCc: rostedt@goodmis.org\nCc: Yonghong Song \u003cyhs@fb.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Ingo Molnar \u003cmingo@redhat.com\u003e\nCc: Alexei Starovoitov \u003cast@kernel.org\u003e\nCc: jeffv@google.com\nCc: Jiri Olsa \u003cjolsa@redhat.com\u003e\nCc: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: primiano@google.com\nCc: Song Liu \u003csongliubraving@fb.com\u003e\nCc: rsavitski@google.com\nCc: Namhyung Kim \u003cnamhyung@kernel.org\u003e\nCc: Matthew Garrett \u003cmatthewgarrett@google.com\u003e\nLink: https://lkml.kernel.org/r/20191014170308.70668-1-joel@joelfernandes.org\nChange-Id: Ifa962e82df9e7fbb167199793da0deaa46e6a1e5\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/2502\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\nReviewed-by: Aditya Kali \u003cadityakali@google.com\u003e\n(cherry picked from commit 32f7dedff547c8e35d3a0fa912f1be6639f16cc3)\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/2682\n", "tree_diff": [ { "type": "modify", "old_id": "ca92e01d0bd1b11a413949e0d526933cf0a112c0", "old_mode": 33188, "old_path": "arch/powerpc/perf/core-book3s.c", "new_id": "48604625ab31d54692b428d824bb981dbed92753", "new_mode": 33188, "new_path": "arch/powerpc/perf/core-book3s.c" }, { "type": "modify", "old_id": "741540d849f3c65a63d78b6ca1fb011d9b7d05b0", "old_mode": 33188, "old_path": "arch/x86/events/intel/bts.c", "new_id": "6a3b599ee0fe7df0fe8010218100e8f9db08acf5", "new_mode": 33188, "new_path": "arch/x86/events/intel/bts.c" }, { "type": "modify", "old_id": "0461ab257df6164998fb7ef52746548b7cdd9d19", "old_mode": 33188, "old_path": "arch/x86/events/intel/core.c", "new_id": "711abf064819bf671ed6e2a7632e09ad2642eb59", "new_mode": 33188, "new_path": "arch/x86/events/intel/core.c" }, { "type": "modify", "old_id": "dee579efb2b23048b0c43e475564e179e20c2181", "old_mode": 33188, "old_path": "arch/x86/events/intel/p4.c", "new_id": "a4cc66005ce85004174f076150b7d7aa34ae5b62", "new_mode": 33188, "new_path": "arch/x86/events/intel/p4.c" }, { "type": "modify", "old_id": "0bdcfdb811b1cfe44bb908d4e8729fdc9bd83346", "old_mode": 33188, "old_path": "include/linux/lsm_hooks.h", "new_id": "129978601945edb35ced6a39d5520f931d8cc843", "new_mode": 33188, "new_path": "include/linux/lsm_hooks.h" }, { "type": "modify", "old_id": "68ccc5b1913b485ba940dc6fa283a6ec7c0a381d", "old_mode": 33188, "old_path": "include/linux/perf_event.h", "new_id": "4f77b22d47be0b52f386494286593eda61afcffb", "new_mode": 33188, "new_path": "include/linux/perf_event.h" }, { "type": "modify", "old_id": "404b421c52e03e8aad4ba43663077a01f48cb648", "old_mode": 33188, "old_path": "include/linux/security.h", "new_id": "2c48c45ab855595252f58ddef1acadee3537572f", "new_mode": 33188, "new_path": "include/linux/security.h" }, { "type": "modify", "old_id": "aaaf50b25cc990f403bb7f7856147ab9a897531a", "old_mode": 33188, "old_path": "kernel/events/core.c", "new_id": "8740d392ca64ca02ca6999d18bed3c1a027b38ba", "new_mode": 33188, "new_path": "kernel/events/core.c" }, { "type": "modify", "old_id": "a9dfa04ffa4499117833495aded1db5fdc19eedd", "old_mode": 33188, "old_path": "kernel/trace/trace_event_perf.c", "new_id": "643e0b19920d25be593f9bce0be837fe1a6bdc38", "new_mode": 33188, "new_path": "kernel/trace/trace_event_perf.c" }, { "type": "modify", "old_id": "36196eb82b050e4644445e448c40914b5508d948", "old_mode": 33188, "old_path": "security/security.c", "new_id": "a21fae979028d9ef673fb19b7ff8972f3a794a3a", "new_mode": 33188, "new_path": "security/security.c" }, { "type": "modify", "old_id": "552e73d90fd25d62a93c41382652e8bedf08042b", "old_mode": 33188, "old_path": "security/selinux/hooks.c", "new_id": "61f3560ad921c996d33f28f840bae0968bbf23e4", "new_mode": 33188, "new_path": "security/selinux/hooks.c" }, { "type": "modify", "old_id": "32e9b03be3dd43e127f0aba3c97d38c9b0d5fce9", "old_mode": 33188, "old_path": "security/selinux/include/classmap.h", "new_id": "7db24855e12d4c19c1162e6ad04b254f92bd036e", "new_mode": 33188, "new_path": "security/selinux/include/classmap.h" }, { "type": "modify", "old_id": "586b7abd0aa73804b70aa304bd781b9f30e48f6c", "old_mode": 33188, "old_path": "security/selinux/include/objsec.h", "new_id": "a4a86cbcfb0aca894d4113eb54671e0faafeedad", "new_mode": 33188, "new_path": "security/selinux/include/objsec.h" } ] }