[PATCH v5 0/5] Enable perf tracing for unprivileged users

Anubhav Shelat <[email protected]>
Newsgroups org.kernel.vger.linux-trace-kernel,org.kernel.vger.linux-kernel,org.kernel.vger.linux-perf-users
Message-ID <[email protected]>
Enable users to use perf-trace to trace their own processes, like strace
but without the overhead of ptrace(). Ensure that users cannot access
other users' or systemwide tracing data.

Changes in v5:
- Move event_define_fields() before directory creation. If
  event_define_fields() fails then we don't need to cleanup whatever
  dirs were created. 
- New read-only eventfs file system with the same structure as
  /sys/kernel/tracing/events/ to handle files read by unprivileged
  users.
- Allow unprivileged users to fall back to /sys/kernel/events/ when they
  cannot access /sys/kernel/tracing/events/.
- Factor out reused code into helper function that checks if a
  tracepoint should be restricted in commit 5.

Changes in v4:
- Preserve security_perf_event_open(PERF_SECURITY_KERNEL) LSM hook in
  the tp_bypass path.
- Lift the PERF_SAMPLE_IP check out of the tp_bypass path above the
  PERF_SAMPLE_RAW branch so it applies to counting and sampling. This
  also allows us to ensure PERF_SAMPLE_IP is set for uprobes.
- Block counting path for TRACE_EVENT_FL_CAP_ANY for unprivileged users
  with sysctl_perf_event_paranoid > 1.

Changes in v3:
- Don't set PERF_SAMPLE_IP for unprivileged tracepoints. This allows us
  to exclude PERF_SAMPLE_IP from kaddr_leak without weakening KASLR.
- Mount tracefs as world-traversable so users can access eventfs
  directories.

Anubhav Shelat (5):
  eventfs: define event fields before directory creation
  tracefs: add read-only eventfs filesystem at /sys/kernel/events
  perf tools: fall back to eventfs for unprivileged event discovery
  perf evsel: don't set PERF_SAMPLE_IP for unprivileged tracepoints
  perf: enable unprivileged syscall tracing with perf trace

 fs/tracefs/event_inode.c           |  61 ++++++++++++++++++
 fs/tracefs/inode.c                 |  95 ++++++++++++++++++++++++++-
 fs/tracefs/internal.h              |   3 +
 include/linux/trace_events.h       |   1 +
 include/linux/tracefs.h            |   4 ++
 include/uapi/linux/magic.h         |   1 +
 kernel/events/core.c               |  28 +++++++-
 kernel/trace/trace.h               |   2 +
 kernel/trace/trace_event_perf.c    |  28 +++++++-
 kernel/trace/trace_events.c        | 100 +++++++++++++++++++++++++++--
 tools/lib/api/fs/fs.c              |  10 +++
 tools/lib/api/fs/fs.h              |   1 +
 tools/lib/api/fs/tracing_path.c    |  52 +++++++++++++--
 tools/lib/api/fs/tracing_path.h    |   1 +
 tools/perf/util/evsel.c            |  14 +++-
 tools/perf/util/tp_pmu.c           |   5 +-
 tools/perf/util/trace-event-info.c |  19 +++---
 17 files changed, 395 insertions(+), 30 deletions(-)

-- 
2.54.0
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.