Re: [RFC] perf: Allow fine-grained PMU access control

From: Tvrtko Ursulin
Date: Tue May 22 2018 - 04:35:20 EST



On 22/05/18 10:05, Peter Zijlstra wrote:
On Mon, May 21, 2018 at 10:25:49AM +0100, Tvrtko Ursulin wrote:
From: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx>

For situations where sysadmins might want to allow different level of
of access control for different PMUs, we start creating per-PMU
perf_event_paranoid controls in sysfs.

Could you explain how exactly this makes sense?

For example, how does it make sense for one PMU to reveal kernel data
while another PMU is not allowed.

Once you allow one PMU to do so, the secret is out.

So please explain, in excruciating detail, how you want to use this and
how exactly that makes sense from a security pov.

Not sure it will be excruciating but will try to explain once again.

There are two things:

1. i915 PMU which exports data such as different engine busyness levels. (Perhaps you remember, you helped us implement this from the perf API angle.)

2. Customers who want to look at those stats in production.

They want to use it to answer questions such as:

a) How loaded is my server and can it take one more of X type of job?
b) What is the least utilised video engine to submit the next packet of work to?
c) What is the least utilised server to schedule the next transcoding job on?

Current option for them is to turn off the global paranoid setting which then enables unprivileged access to _all_ PMU providers.

To me it sounded quite logical that it would be better for the paranoid knob to be more fine-grained, so that they can configure their servers so only access to needed data is possible.

I am not sure what do you mean by "Once you allow one PMU to do so, the secret is out."? What secret? Are you implying that enabling unprivileged access to i915 engine busyness data opens up access to CPU PMU's as well via some side channel?

Regards,

Tvrtko

These work in equivalent fashion as the existing perf_event_paranoid
sysctl, which now becomes the parent control for each PMU.

On PMU registration the global/parent value will be inherited by each PMU,
as it will be propagated to all registered PMUs when the sysctl is
updated.

At any later point individual PMU access controls, located in
<sysfs>/device/<pmu-name>/perf_event_paranoid, can be adjusted to achieve
fine grained access control.