Commit 1ccd15497869f3ed83b5225d410df53a96e52757
Committed by
Ingo Molnar
1 parent
9ee318a782
Exists in
master
and in
4 other branches
perf_counter: sysctl for system wide perf counters
Impact: add sysctl for paranoid/relaxed perfcounters policy Allow the use of system wide perf counters to everybody, but provide a sysctl to disable it for the paranoid security minded. Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Paul Mackerras <paulus@samba.org> Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com> LKML-Reference: <20090409085524.514046352@chello.nl> Signed-off-by: Ingo Molnar <mingo@elte.hu>
Showing 3 changed files with 16 additions and 1 deletions Side-by-side Diff
include/linux/perf_counter.h
kernel/perf_counter.c
... | ... | @@ -42,6 +42,8 @@ |
42 | 42 | static atomic_t nr_munmap_tracking __read_mostly; |
43 | 43 | static atomic_t nr_comm_tracking __read_mostly; |
44 | 44 | |
45 | +int sysctl_perf_counter_priv __read_mostly; /* do we need to be privileged */ | |
46 | + | |
45 | 47 | /* |
46 | 48 | * Mutex for (sysadmin-configurable) counter reservations: |
47 | 49 | */ |
... | ... | @@ -1132,7 +1134,7 @@ |
1132 | 1134 | */ |
1133 | 1135 | if (cpu != -1) { |
1134 | 1136 | /* Must be root to operate on a CPU counter: */ |
1135 | - if (!capable(CAP_SYS_ADMIN)) | |
1137 | + if (sysctl_perf_counter_priv && !capable(CAP_SYS_ADMIN)) | |
1136 | 1138 | return ERR_PTR(-EACCES); |
1137 | 1139 | |
1138 | 1140 | if (cpu < 0 || cpu > num_possible_cpus()) |
kernel/sysctl.c
... | ... | @@ -49,6 +49,7 @@ |
49 | 49 | #include <linux/reboot.h> |
50 | 50 | #include <linux/ftrace.h> |
51 | 51 | #include <linux/slow-work.h> |
52 | +#include <linux/perf_counter.h> | |
52 | 53 | |
53 | 54 | #include <asm/uaccess.h> |
54 | 55 | #include <asm/processor.h> |
... | ... | @@ -918,6 +919,16 @@ |
918 | 919 | .procname = "slow-work", |
919 | 920 | .mode = 0555, |
920 | 921 | .child = slow_work_sysctls, |
922 | + }, | |
923 | +#endif | |
924 | +#ifdef CONFIG_PERF_COUNTERS | |
925 | + { | |
926 | + .ctl_name = CTL_UNNUMBERED, | |
927 | + .procname = "perf_counter_privileged", | |
928 | + .data = &sysctl_perf_counter_priv, | |
929 | + .maxlen = sizeof(sysctl_perf_counter_priv), | |
930 | + .mode = 0644, | |
931 | + .proc_handler = &proc_dointvec, | |
921 | 932 | }, |
922 | 933 | #endif |
923 | 934 | /* |