Commit b068fc04 authored by Marco Elver's avatar Marco Elver Committed by Peter Zijlstra
Browse files

perf: Refactor permissions check into perf_check_permission() 



Refactor the permission check in perf_event_open() into a helper
perf_check_permission(). This makes the permission check logic more
readable (because we no longer have a negated disjunction). Add a
comment mentioning the ptrace check also checks the uid.

No functional change intended.

Signed-off-by: default avatarMarco Elver <elver@google.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarDmitry Vyukov <dvyukov@google.com>
Link: https://lore.kernel.org/r/20210705084453.2151729-2-elver@google.com
parent 9d7a6c95

kernel/events/core.c

+32 −26
Original line number Diff line number Diff line
@@ -11917,6 +11917,37 @@ __perf_event_ctx_lock_double(struct perf_event *group_leader, 
	return gctx;

}



static bool

perf_check_permission(struct perf_event_attr *attr, struct task_struct *task)

{

	unsigned int ptrace_mode = PTRACE_MODE_READ_REALCREDS;

	bool is_capable = perfmon_capable();



	if (attr->sigtrap) {

		/*

		 * perf_event_attr::sigtrap sends signals to the other task.

		 * Require the current task to also have CAP_KILL.

		 */

		rcu_read_lock();

		is_capable &= ns_capable(__task_cred(task)->user_ns, CAP_KILL);

		rcu_read_unlock();



		/*

		 * If the required capabilities aren't available, checks for

		 * ptrace permissions: upgrade to ATTACH, since sending signals

		 * can effectively change the target task.

		 */

		ptrace_mode = PTRACE_MODE_ATTACH_REALCREDS;

	}



	/*

	 * Preserve ptrace permission check for backwards compatibility. The

	 * ptrace check also includes checks that the current task and other

	 * task have matching uids, and is therefore not done here explicitly.

	 */

	return is_capable || ptrace_may_access(task, ptrace_mode);

}



/**

 * sys_perf_event_open - open a performance event, associate it to a task/cpu

 *
@@ -12158,43 +12189,18 @@ SYSCALL_DEFINE5(perf_event_open, 
	}



	if (task) {

		unsigned int ptrace_mode = PTRACE_MODE_READ_REALCREDS;

		bool is_capable;



		err = down_read_interruptible(&task->signal->exec_update_lock);

		if (err)

			goto err_file;



		is_capable = perfmon_capable();

		if (attr.sigtrap) {

			/*

			 * perf_event_attr::sigtrap sends signals to the other

			 * task. Require the current task to also have

			 * CAP_KILL.

			 */

			rcu_read_lock();

			is_capable &= ns_capable(__task_cred(task)->user_ns, CAP_KILL);

			rcu_read_unlock();



			/*

			 * If the required capabilities aren't available, checks

			 * for ptrace permissions: upgrade to ATTACH, since

			 * sending signals can effectively change the target

			 * task.

			 */

			ptrace_mode = PTRACE_MODE_ATTACH_REALCREDS;

		}



		/*

		 * Preserve ptrace permission check for backwards compatibility.

		 *

		 * We must hold exec_update_lock across this and any potential

		 * perf_install_in_context() call for this new event to

		 * serialize against exec() altering our credentials (and the

		 * perf_event_exit_task() that could imply).

		 */

		err = -EACCES;

		if (!is_capable && !ptrace_may_access(task, ptrace_mode))

		if (!perf_check_permission(&attr, task))

			goto err_cred;

	}