[linux] 01/02: security, perf: Replace GRKERNSEC_PERF_HARDEN patch with the version submitted upstream
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Wed Oct 5 21:28:02 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch master
in repository linux.
commit 6573a2a7c7748e81329c494fc89a373d24f0ef00
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Wed Oct 5 22:23:08 2016 +0100
security,perf: Replace GRKERNSEC_PERF_HARDEN patch with the version submitted upstream
This hasn't been *accepted* upstream, but maybe some day? It has gone
into AOSP.
---
debian/changelog | 2 +
debian/config/config | 6 +-
.../all/grsecurity/grkernsec_perf_harden.patch | 76 ----------------------
...ow-further-restriction-of-perf_event_open.patch | 75 +++++++++++++++++++++
debian/patches/series | 2 +-
5 files changed, 79 insertions(+), 82 deletions(-)
diff --git a/debian/changelog b/debian/changelog
index e1c60a4..54ee55a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -13,6 +13,8 @@ linux (4.8-1~exp1) UNRELEASED; urgency=medium
* [mips*] Enable RANDOMIZE_BASE
* Enable SLAB_FREELIST_RANDOM
* [arm*,powerpc*,s390x,sparc64,x86] Enable HARDENED_USERCOPY
+ * security,perf: Replace GRKERNSEC_PERF_HARDEN patch with the version
+ submitted upstream
-- Ben Hutchings <ben at decadent.org.uk> Sat, 01 Oct 2016 21:51:33 +0100
diff --git a/debian/config/config b/debian/config/config
index 21a8a5d..14036b4 100644
--- a/debian/config/config
+++ b/debian/config/config
@@ -5460,11 +5460,6 @@ CONFIG_XFS_RT=y
# CONFIG_XFS_DEBUG is not set
##
-## file: grsecurity/Kconfig
-##
-CONFIG_GRKERNSEC_PERF_HARDEN=y
-
-##
## file: init/Kconfig
##
CONFIG_CROSS_COMPILE=""
@@ -6649,6 +6644,7 @@ CONFIG_NET_KEY_MIGRATE=y
## file: security/Kconfig
##
CONFIG_GRKERNSEC=y
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
CONFIG_SECURITY=y
CONFIG_SECURITY_NETWORK=y
CONFIG_SECURITY_NETWORK_XFRM=y
diff --git a/debian/patches/features/all/grsecurity/grkernsec_perf_harden.patch b/debian/patches/features/all/grsecurity/grkernsec_perf_harden.patch
deleted file mode 100644
index 110d2d4..0000000
--- a/debian/patches/features/all/grsecurity/grkernsec_perf_harden.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From: Ben Hutchings <ben at decadent.org.uk>
-Subject: grsecurity: GRKERNSEC_PERF_HARDEN
-Origin: https://grsecurity.net/test/grsecurity-3.1-4.1.3-201507261932.patch
-
-The GRKERNSEC_PERF_HARDEN feature extracted from grsecurity. Adds the
-option to disable perf_event_open() entirely for unprivileged users.
-This standalone version doesn't include making the variable read-only
-(or renaming it).
-
----
---- a/include/linux/perf_event.h
-+++ b/include/linux/perf_event.h
-@@ -1122,6 +1122,11 @@ extern int perf_cpu_time_max_percent_han
- int perf_event_max_stack_handler(struct ctl_table *table, int write,
- void __user *buffer, size_t *lenp, loff_t *ppos);
-
-+static inline bool perf_paranoid_any(void)
-+{
-+ return sysctl_perf_event_paranoid > 2;
-+}
-+
- static inline bool perf_paranoid_tracepoint_raw(void)
- {
- return sysctl_perf_event_paranoid > -1;
---- a/kernel/events/core.c
-+++ b/kernel/events/core.c
-@@ -352,8 +352,13 @@ static struct srcu_struct pmus_srcu;
- * 0 - disallow raw tracepoint access for unpriv
- * 1 - disallow cpu events for unpriv
- * 2 - disallow kernel profiling for unpriv
-+ * 3 - disallow all unpriv perf event use
- */
-+#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
-+int sysctl_perf_event_paranoid __read_mostly = 3;
-+#else
- int sysctl_perf_event_paranoid __read_mostly = 2;
-+#endif
-
- /* Minimum for 512 kiB + 1 user control page */
- int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
-@@ -9181,6 +9186,11 @@ SYSCALL_DEFINE5(perf_event_open,
- if (flags & ~PERF_FLAG_ALL)
- return -EINVAL;
-
-+#ifdef CONFIG_GRKERNSEC_PERF_HARDEN
-+ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
-+ return -EACCES;
-+#endif
-+
- err = perf_copy_attr(attr_uptr, &attr);
- if (err)
- return err;
---- a/grsecurity/Kconfig
-+++ b/grsecurity/Kconfig
-@@ -1,3 +1,21 @@
- #
- # grecurity configuration
- #
-+config GRKERNSEC_PERF_HARDEN
-+ bool "Disable unprivileged PERF_EVENTS usage by default"
-+ depends on PERF_EVENTS
-+ help
-+ If you say Y here, the range of acceptable values for the
-+ /proc/sys/kernel/perf_event_paranoid sysctl will be expanded to allow and
-+ default to a new value: 3. When the sysctl is set to this value, no
-+ unprivileged use of the PERF_EVENTS syscall interface will be permitted.
-+
-+ Though PERF_EVENTS can be used legitimately for performance monitoring
-+ and low-level application profiling, it is forced on regardless of
-+ configuration, has been at fault for several vulnerabilities, and
-+ creates new opportunities for side channels and other information leaks.
-+
-+ This feature puts PERF_EVENTS into a secure default state and permits
-+ the administrator to change out of it temporarily if unprivileged
-+ application profiling is needed.
-+
diff --git a/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch b/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
new file mode 100644
index 0000000..6acd429
--- /dev/null
+++ b/debian/patches/features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
@@ -0,0 +1,75 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Mon, 11 Jan 2016 15:23:55 +0000
+Subject: security,perf: Allow further restriction of perf_event_open
+Forwarded: https://lkml.org/lkml/2016/1/11/587
+
+When kernel.perf_event_open is set to 3 (or greater), disallow all
+access to performance events by users without CAP_SYS_ADMIN.
+Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
+makes this value the default.
+
+This is based on a similar feature in grsecurity
+(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
+the variable read-only. It also allows enabling further restriction
+at run-time regardless of whether the default is changed.
+
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+--- a/include/linux/perf_event.h
++++ b/include/linux/perf_event.h
+@@ -1145,6 +1145,11 @@ extern int perf_cpu_time_max_percent_han
+ int perf_event_max_stack_handler(struct ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos);
+
++static inline bool perf_paranoid_any(void)
++{
++ return sysctl_perf_event_paranoid > 2;
++}
++
+ static inline bool perf_paranoid_tracepoint_raw(void)
+ {
+ return sysctl_perf_event_paranoid > -1;
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -389,8 +389,13 @@ static struct srcu_struct pmus_srcu;
+ * 0 - disallow raw tracepoint access for unpriv
+ * 1 - disallow cpu events for unpriv
+ * 2 - disallow kernel profiling for unpriv
++ * 3 - disallow all unpriv perf event use
+ */
++#ifdef CONFIG_SECURITY_PERF_EVENTS_RESTRICT
++int sysctl_perf_event_paranoid __read_mostly = 3;
++#else
+ int sysctl_perf_event_paranoid __read_mostly = 2;
++#endif
+
+ /* Minimum for 512 kiB + 1 user control page */
+ int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
+@@ -9395,6 +9400,9 @@ SYSCALL_DEFINE5(perf_event_open,
+ if (flags & ~PERF_FLAG_ALL)
+ return -EINVAL;
+
++ if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
++ return -EACCES;
++
+ err = perf_copy_attr(attr_uptr, &attr);
+ if (err)
+ return err;
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -18,6 +18,15 @@ config SECURITY_DMESG_RESTRICT
+
+ If you are unsure how to answer this question, answer N.
+
++config SECURITY_PERF_EVENTS_RESTRICT
++ bool "Restrict unprivileged use of performance events"
++ depends on PERF_EVENTS
++ help
++ If you say Y here, the kernel.perf_event_paranoid sysctl
++ will be set to 3 by default, and no unprivileged use of the
++ perf_event_open syscall will be permitted unless it is
++ changed.
++
+ config SECURITY
+ bool "Enable different security models"
+ depends on SYSFS
diff --git a/debian/patches/series b/debian/patches/series
index 5b5ea1e..ce01a51 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -35,6 +35,7 @@ debian/fs-enable-link-security-restrictions-by-default.patch
debian/sched-autogroup-disabled.patch
debian/yama-disable-by-default.patch
debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
+features/all/security-perf-allow-further-restriction-of-perf_event_open.patch
# Disable autoloading/probing of various drivers by default
debian/cdc_ncm-cdc_mbim-use-ncm-by-default.patch
@@ -68,7 +69,6 @@ bugfix/all/ext4-fix-bug-838544.patch
features/all/grsecurity/grsecurity-kconfig.patch
# Disabled until we add code into the grsecurity/ directory
#features/all/grsecurity/grsecurity-kbuild.patch
-features/all/grsecurity/grkernsec_perf_harden.patch
# Securelevel patchset from mjg59
features/all/securelevel/add-bsd-style-securelevel-support.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list