Re: [GIT PULL][PATCH] perf/ftrace: Fix paranoid level for enablingfunction tracer

[Vince Weaver]

I've run this patch on top of 3.12 and it seems pretty solid.
I've run my perf_fuzzer for hours (which wasn't possible w/o 
quickly crashing on a stock kernel).

Tested-by: Vince Weaver <vincent.weaver@xxxxxxxxx>


On Tue, 5 Nov 2013, Steven Rostedt wrote:

> 
> Linus,
> 
> Please pull the latest ftrace/urgent tree, which can be found at:
> 
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
> ftrace/urgent
> 
> Head SHA1: d1356abac98cce8e7765186f8093da1442d74d1d
> 
> 
> Steven Rostedt (1):
>       perf/ftrace: Fix paranoid level for enabling function tracer
> 
> ----
>  kernel/trace/trace_event_perf.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> ---------------------------
> commit d1356abac98cce8e7765186f8093da1442d74d1d
> Author: Steven Rostedt <rostedt@xxxxxxxxxxx>
> Date:   Tue Nov 5 12:51:11 2013 -0500
> 
>     perf/ftrace: Fix paranoid level for enabling function tracer
>     
>     The current default perf paranoid level is "1" which has
>     "perf_paranoid_kernel()" return false, and giving any operations that
>     use it, access to normal users. Unfortunately, this includes function
>     tracing and normal users should not be allowed to enable function
>     tracing by default.
>     
>     The proper level is defined at "-1" (full perf access), which
>     "perf_paranoid_tracepoint_raw()" will only give access to. Use that
>     check instead for enabling function tracing.
>     
>     Reported-by: Dave Jones <davej@xxxxxxxxxx>
>     Reported-by: Vince Weaver <vincent.weaver@xxxxxxxxx>
>     Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
>     Cc: Ingo Molnar <mingo@xxxxxxxxxx>
>     Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
>     Cc: Frederic Weisbecker <fweisbec@xxxxxxxxx>
>     Cc: stable@xxxxxxxxxxxxxxx # 3.4+
>     CVE: CVE-2013-2930
>     Fixes: ced39002f5ea ("ftrace, perf: Add support to use function tracepoint in perf")
>     Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
> 
> diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
> index 80c36bc..78e27e3 100644
> --- a/kernel/trace/trace_event_perf.c
> +++ b/kernel/trace/trace_event_perf.c
> @@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
>  {
>  	/* The ftrace function trace is allowed only for root. */
>  	if (ftrace_event_is_function(tp_event) &&
> -	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
> +	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
>  		return -EPERM;
>  
>  	/* No tracing, just counting, so no obvious leak */
> 

Vince Weaver
vincent.weaver@xxxxxxxxx
http://www.eece.maine.edu/~vweaver/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/