Re: [patch] x86, ptrace: require admin privileges for ptrace BTS extension

From: stephane eranian
Date: Mon Dec 22 2008 - 08:23:52 EST


Markus,

On Mon, Dec 22, 2008 at 1:02 PM, Markus Metzger
<markus.t.metzger@xxxxxxxxx> wrote:
> Require admin privileges for ptrace BTS extension.
>
Can you explain the motivations for this?

I thought the BTS extension was a per-process functionality.
So how come I can debug and single step my process without
admin privilege and I cannot capture its own branches. Does this
have to do with user vs. kernel execution of the proces (BTS
captures everything if I recall)?

Thanks.

>
> Reported-by: Ingo Molnar <mingo@xxxxxxx>
> Signed-off-by: Markus Metzger <markus.t.metzger@xxxxxxxxx>
> ---
>
> Index: gits/arch/x86/kernel/ptrace.c
> ===================================================================
> --- gits.orig/arch/x86/kernel/ptrace.c 2008-12-22 09:09:25.000000000 +0100
> +++ gits/arch/x86/kernel/ptrace.c 2008-12-22 11:03:01.000000000 +0100
> @@ -21,6 +21,7 @@
> #include <linux/audit.h>
> #include <linux/seccomp.h>
> #include <linux/signal.h>
> +#include <linux/capability.h>
>
> #include <asm/uaccess.h>
> #include <asm/pgtable.h>
> @@ -742,6 +743,10 @@
> struct ptrace_bts_config cfg;
> int error = 0;
>
> + error = -EPERM;
> + if (!capable(CAP_SYS_ADMIN))
> + goto errout;
> +
> error = -EOPNOTSUPP;
> if (!bts_cfg.sizeof_bts)
> goto errout;
> ---------------------------------------------------------------------
> Intel GmbH
> Dornacher Strasse 1
> 85622 Feldkirchen/Muenchen Germany
> Sitz der Gesellschaft: Feldkirchen bei Muenchen
> Geschaeftsfuehrer: Douglas Lusk, Peter Gleissner, Hannes Schwaderer
> Registergericht: Muenchen HRB 47456 Ust.-IdNr.
> VAT Registration No.: DE129385895
> Citibank Frankfurt (BLZ 502 109 00) 600119052
>
> This e-mail and any attachments may contain confidential material for
> the sole use of the intended recipient(s). Any review or distribution
> by others is strictly prohibited. If you are not the intended
> recipient, please contact the sender and delete all copies.
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/