kernel/linux.git/Documentation/admin-guide/perf-security.rst, branch v6.19.11

doc/admin-guide: fix spelling mistake: "perfomance" -> "performance"

2021-02-11T16:38:40+00:00

There is a spelling mistake in the perf-security documentation. Fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20210210115624.53551-1-colin.king@canonical.com Signed-off-by: Jonathan Corbet

doc/admin-guide: Document creation of CAP_PERFMON privileged shell

2020-11-04T12:42:40+00:00

Document steps to create CAP_PERFMON privileged shell to unblock Perf tool usage in cases when capabilities can't be assigned to an executable due to limitations of used file system. Suggested-by: Andi Kleen Signed-off-by: Alexey Budankov Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: linux-doc@vger.kernel.org Cc: linux-man@vger.kernel.org Cc: linux-security-module@vger.kernel.org Link: http://lore.kernel.org/lkml/0abda956-de6c-95b1-61e8-49e146501079@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

doc/admin-guide: Note credentials consolidation under CAP_PERFMON

2020-11-04T12:42:40+00:00

Add note that starting from Linux v5.9 CAP_PERFMON Linux capability is enough to conduct performance monitoring and observability using perf_events API. Signed-off-by: Alexey Budankov Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: linux-doc@vger.kernel.org Cc: linux-man@vger.kernel.org Cc: linux-security-module@vger.kernel.org Link: http://lore.kernel.org/lkml/2b1a92a1-84ce-5c70-837d-8ffe96849588@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

doc/admin-guide: Update perf-security.rst with CAP_PERFMON information

2020-04-16T15:19:10+00:00

Update perf-security.rst documentation file with the information related to usage of CAP_PERFMON capability to secure performance monitoring and observability operations in system. Committer notes: While testing 'perf top' under cap_perfmon I noticed that it needs some more capability and Alexey pointed out cap_ipc_lock, as needed by this kernel chunk: kernel/events/core.c: 6101 if ((locked > lock_limit) && perf_is_paranoid() && !capable(CAP_IPC_LOCK)) { ret = -EPERM; goto unlock; } So I added it to the documentation, and also mentioned that if the libcap version doesn't yet supports 'cap_perfmon', its numeric value can be used instead, i.e. if: # setcap "cap_perfmon,cap_ipc_lock,cap_sys_ptrace,cap_syslog=ep" perf Fails, try: # setcap "38,cap_ipc_lock,cap_sys_ptrace,cap_syslog=ep" perf I also added a paragraph stating that using an unpatched libcap will fail the check for CAP_PERFMON, as it checks the cap number against a maximum to see if it is valid, which makes it use as the default the 'cycles:u' event, even tho a cap_perfmon capable perf binary can get kernel samples, to workaround that just use, e.g.: # perf top -e cycles # perf record -e cycles And it will sample kernel and user modes. Signed-off-by: Alexey Budankov Tested-by: Arnaldo Carvalho de Melo Cc: Alexei Starovoitov Cc: Andi Kleen Cc: Igor Lubashev Cc: James Morris Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Serge Hallyn Cc: Song Liu Cc: Stephane Eranian Cc: Thomas Gleixner Cc: intel-gfx@lists.freedesktop.org Cc: linux-doc@vger.kernel.org Cc: linux-man@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: selinux@vger.kernel.org Link: http://lore.kernel.org/lkml/17278551-9399-9ebe-d665-8827016a217d@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

perf-security: wrap paragraphs on 72 columns

2019-02-17T23:05:00+00:00

Implemented formatting of paragraphs to be not wider than 72 columns. Signed-off-by: Alexey Budankov Signed-off-by: Jonathan Corbet

perf-security: elaborate on perf_events/Perf privileged users

2019-02-17T23:04:56+00:00

Elaborate on possible perf_event/Perf privileged users groups and document steps about creating such groups. Signed-off-by: Alexey Budankov Signed-off-by: Jonathan Corbet

perf-security: document collected perf_events/Perf data categories

2019-02-17T23:04:51+00:00

Document and categorize system and performance data into groups that can be captured by perf_events/Perf and explicitly indicate the group that can contain process sensitive data. Signed-off-by: Alexey Budankov Signed-off-by: Jonathan Corbet

perf-security: document perf_events/Perf resource control

2019-02-17T23:04:45+00:00

Extend perf-security.rst file with perf_events/Perf resource control section describing RLIMIT_NOFILE and perf_event_mlock_kb settings for performance monitoring user processes. Signed-off-by: Alexey Budankov Signed-off-by: Jonathan Corbet

Documentation/admin-guide: introduce perf-security.rst file

2018-12-06T16:50:33+00:00

Implement initial version of perf-security.rst documentation file covering security concerns of perf_event_paranoid settings. Suggested-by: Thomas Gleixner Signed-off-by: Alexey Budankov Reviewed-by: Kees Cook Signed-off-by: Jonathan Corbet