seccomp: allow perf_event_open if CAP_PERFMON #424
Conversation
Previously perf_event_open was only allowed if both CAP_SYS_ADMIN and CAP_PERFMON were granted. CAP_SYS_ADMIN in particular is a very overloaded capability and is best avoided. This commit enables perf_event_open if either (or both) capabilities are set, in particular this enables containers with only CAP_PERFMON to profile itself. This change does not deny anything new, nor does it enable perf_event_open by default. Signed-off-by: Jonathon Anderson <anderson.jonathonm@gmail.com>
|
✅ A new PR has been created in buildah to vendor these changes: containers/buildah#6461 |
|
@giuseppe PTAL. Historically I can see containers/common@daa81f1 was already supposed to enable this, which makes me worried about this PR. |
|
cc @martinetd |
this new PR enables it with CAP_PERFMON which seems to me like a good idea |
martinetd
left a comment
martinetd
left a comment
There was a problem hiding this comment.
Oww, I had managed to screw up that old commit in two different places, sorry for that mess.
This diff looks good to me, both the moving from eperm-if-not-sysadmin to allow-if-sysadmin and deny-if-not-sysadmin-or-perfmon instead of deny-if-not-sysadmin-or-bpf parts are sound.
Just in case I also had a new look at the other commits of that old PR ( https://github.com/containers/common/pull/2040/commits ) and the only similar commit was about bpf, which looks correct to me, so I'm a bit confused about how this got so bad... Sorry again, and thanks for the cc!
|
Thanks @blue42u and @martinetd ! |
6 participants
Currently
perf_event_openis only allowed if bothCAP_SYS_ADMINandCAP_PERFMONare enabled.CAP_SYS_ADMINis a very overloaded capability and is best avoided. This PR enablesperf_event_openif either (or both) capabilities are enabled. In particular, this enables a container to profile itself by only enablingCAP_PERFMON.This change does not deny anything new, nor does it enable
perf_event_openby default. In summary:perf_event_openreturn (before)perf_event_openreturn (after)CAP_PERFMON+CAP_SYS_ADMINCAP_PERFMONEPERMCAP_SYS_ADMINENOSYSEPERMEPERM