mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-06 00:39:48 +00:00
Code Issues Releases Wiki Activity

s390/cpum_cf: open access to hwctr device for CAP_PERFMON privileged process

Browse source 
The device /dev/hwctr was introduced to access complete
CPU Measurement facility counter sets via an ioctl system call.
The access the to device is limited to privileged processes
running as root or superuser. The capability CAP_SYS_ADMIN
is required.  The device permissions are read/write for the
device owner root. There is no need for this restriction.

Make the device access permission read/write for all and
reduce the capabilities to CAP_PERFMON.
Any user space program with the CAP_PERFMON capability assigned to it
can now read and display the CPU Measurement facility counter sets.

For more details on perf tool usage and security, see linux
documentation in Documentation/admin-guide/perf-security.rst.

Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
This commit is contained in:
Thomas Richter 2023-06-14 09:37:42 +02:00 committed by Alexander Gordeev
parent 11458e2b3f
commit d0d3e218d5
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
arch/s390/kernel/perf_cpum_cf.c
View file

@ -1213,7 +1213,7 @@ static int cfset_release(struct inode *inode, struct file *file)
static int cfset_open(struct inode *inode, struct file *file)
{
if (!capable(CAP_SYS_ADMIN))
if (!perfmon_capable())
return -EPERM;
mutex_lock(&cfset_ctrset_mutex);
if (atomic_inc_return(&cfset_opencnt) == 1)
@ -1502,6 +1502,7 @@ static struct miscdevice cfset_dev = {
.name = S390_HWCTR_DEVICE,
.minor = MISC_DYNAMIC_MINOR,
.fops = &cfset_fops,
.mode = 0666,
};
/* Hotplug add of a CPU. Scan through all active processes and add