> Count-only perf tracepoint events can be opened without tracepoint
> permission because they do not expose raw sample data. Their
> PERF_EVENT_IOC_SET_FILTER ioctl can still pass filter expressions to the
> tracing parser.
>
> A .function operand makes the parser resolve either a numeric kernel
> address or a kernel symbol. The ioctl return value can therefore be used
> as an oracle to recover the randomized kernel text base.
>
> Trace events marked TRACE_EVENT_FL_CAP_ANY are different: task-local
> events may expose their raw fields to unprivileged users. Syscall
> tracepoints and uprobes deliberately use this exception, so denying every
> filter without tracepoint permission would break their ordinary filters.
>
> Check perf_allow_tracepoint() in perf. If permission is denied, continue
> only for a task-attached TRACE_EVENT_FL_CAP_ANY event whose filter does
> not contain an unquoted .function postfix. This rejects the predicate
> before the tracing parser can resolve either form of operand. The scan
> uses the parser's quote rules, so .function inside a string operand
> remains an ordinary filter value.
>
> This preserves ordinary filters on task-local events whose fields are
> already available to the caller, while non-CAP_ANY filters and kernel
> address resolution remain unavailable without tracepoint permission.
>
> Fixes: e6745a4da964 ("tracing: Add a way to filter function addresses to
> function names")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Zhengchuan Liang <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
