Revert "ANDROID: security,perf: Allow further restriction of perf_event_open"
Unfork Android. This reverts commit8e5e42d5ae
. Perf_event_paranoid=3 is no longer needed on Android. Access control of perf events is now done by selinux. See: https://patchwork.kernel.org/patch/11185793/. Bug: 120445712 Bug: 137092007 Signed-off-by: Jeff Vander Stoep <jeffv@google.com> Change-Id: Iba493424174b30baff460caaa25a54a472c87bd4 Git-commit:025a1ee618
Git-repo: https://android.googlesource.com/kernel/common/ Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
This commit is contained in:
parent
ed3e23c18b
commit
a2f0b097d5
6 changed files with 1 additions and 27 deletions
|
@ -720,8 +720,7 @@ allowed to execute.
|
|||
perf_event_paranoid:
|
||||
|
||||
Controls use of the performance events system by unprivileged
|
||||
users (without CAP_SYS_ADMIN). The default value is 3 if
|
||||
CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 2 otherwise.
|
||||
users (without CAP_SYS_ADMIN). The default value is 2.
|
||||
|
||||
-1: Allow use of (almost) all events by all users
|
||||
Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
|
||||
|
@ -729,7 +728,6 @@ CONFIG_SECURITY_PERF_EVENTS_RESTRICT is set, or 2 otherwise.
|
|||
Disallow raw tracepoint access by users without CAP_SYS_ADMIN
|
||||
>=1: Disallow CPU event access by users without CAP_SYS_ADMIN
|
||||
>=2: Disallow kernel profiling by users without CAP_SYS_ADMIN
|
||||
>=3: Disallow all event access by users without CAP_SYS_ADMIN
|
||||
|
||||
==============================================================
|
||||
|
||||
|
|
|
@ -484,7 +484,6 @@ CONFIG_NLS_MAC_ROMANIAN=y
|
|||
CONFIG_NLS_MAC_TURKISH=y
|
||||
CONFIG_NLS_UTF8=y
|
||||
CONFIG_UNICODE=y
|
||||
CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
|
||||
CONFIG_SECURITY=y
|
||||
CONFIG_SECURITYFS=y
|
||||
CONFIG_SECURITY_NETWORK=y
|
||||
|
|
|
@ -418,7 +418,6 @@ CONFIG_NLS_MAC_ROMANIAN=y
|
|||
CONFIG_NLS_MAC_TURKISH=y
|
||||
CONFIG_NLS_UTF8=y
|
||||
CONFIG_UNICODE=y
|
||||
CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
|
||||
CONFIG_SECURITY=y
|
||||
CONFIG_SECURITYFS=y
|
||||
CONFIG_SECURITY_NETWORK=y
|
||||
|
|
|
@ -1225,11 +1225,6 @@ int perf_event_max_stack_handler(struct ctl_table *table, int write,
|
|||
#define PERF_SECURITY_KERNEL 2
|
||||
#define PERF_SECURITY_TRACEPOINT 3
|
||||
|
||||
static inline bool perf_paranoid_any(void)
|
||||
{
|
||||
return sysctl_perf_event_paranoid > 2;
|
||||
}
|
||||
|
||||
static inline int perf_is_paranoid(void)
|
||||
{
|
||||
return sysctl_perf_event_paranoid > -1;
|
||||
|
|
|
@ -431,13 +431,8 @@ static cpumask_var_t perf_online_mask;
|
|||
* 0 - disallow raw tracepoint access for unpriv
|
||||
* 1 - disallow cpu events for unpriv
|
||||
* 2 - disallow kernel profiling for unpriv
|
||||
* 3 - disallow all unpriv perf event use
|
||||
*/
|
||||
#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
|
||||
int sysctl_perf_event_paranoid __read_mostly = 3;
|
||||
#else
|
||||
int sysctl_perf_event_paranoid __read_mostly = 2;
|
||||
#endif
|
||||
|
||||
/* Minimum for 512 kiB + 1 user control page */
|
||||
int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
|
||||
|
@ -10889,9 +10884,6 @@ SYSCALL_DEFINE5(perf_event_open,
|
|||
if (flags & ~PERF_FLAG_ALL)
|
||||
return -EINVAL;
|
||||
|
||||
if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
|
||||
return -EACCES;
|
||||
|
||||
/* Do we allow access to perf_event_open(2) ? */
|
||||
err = security_perf_event_open(&attr, PERF_SECURITY_OPEN);
|
||||
if (err)
|
||||
|
|
|
@ -18,15 +18,6 @@ config SECURITY_DMESG_RESTRICT
|
|||
|
||||
If you are unsure how to answer this question, answer N.
|
||||
|
||||
config SECURITY_PERF_EVENTS_RESTRICT
|
||||
bool "Restrict unprivileged use of performance events"
|
||||
depends on PERF_EVENTS
|
||||
help
|
||||
If you say Y here, the kernel.perf_event_paranoid sysctl
|
||||
will be set to 3 by default, and no unprivileged use of the
|
||||
perf_event_open syscall will be permitted unless it is
|
||||
changed.
|
||||
|
||||
config SECURITY
|
||||
bool "Enable different security models"
|
||||
depends on SYSFS
|
||||
|
|
Loading…
Reference in a new issue