| Message ID | b74a3983-8e41-aba7-c18d-b16eff6fd5e5@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Introduce CAP_PERFMON to secure system performance monitoring and observability | expand |
On 1/20/20 5:00 PM, Alexey Budankov wrote: > Open access to monitoring for CAP_PERFMON privileged processes. > For backward compatibility reasons access to the monitoring remains > open for CAP_SYS_ADMIN privileged processes but CAP_SYS_ADMIN usage > for secure monitoring is discouraged with respect to CAP_PERFMON > capability. Providing the access under CAP_PERFMON capability singly, > without the rest of CAP_SYS_ADMIN credentials, excludes chances to > misuse the credentials and makes the operations more secure. > > Signed-off-by: Alexey Budankov<alexey.budankov@linux.intel.com> > --- Acked-by: Anju T Sudhakar<anju@linux.vnet.ibm.com>
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c index cb50a9e1fd2d..e837717492e4 100644 --- a/arch/powerpc/perf/imc-pmu.c +++ b/arch/powerpc/perf/imc-pmu.c @@ -898,7 +898,7 @@ static int thread_imc_event_init(struct perf_event *event) if (event->attr.type != event->pmu->type) return -ENOENT; - if (!capable(CAP_SYS_ADMIN)) + if (!perfmon_capable()) return -EACCES; /* Sampling not supported */ @@ -1307,7 +1307,7 @@ static int trace_imc_event_init(struct perf_event *event) if (event->attr.type != event->pmu->type) return -ENOENT; - if (!capable(CAP_SYS_ADMIN)) + if (!perfmon_capable()) return -EACCES; /* Return if this is a couting event */
Open access to monitoring for CAP_PERFMON privileged processes. For backward compatibility reasons access to the monitoring remains open for CAP_SYS_ADMIN privileged processes but CAP_SYS_ADMIN usage for secure monitoring is discouraged with respect to CAP_PERFMON capability. Providing the access under CAP_PERFMON capability singly, without the rest of CAP_SYS_ADMIN credentials, excludes chances to misuse the credentials and makes the operations more secure. Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com> --- arch/powerpc/perf/imc-pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)