A task-bound, counting-only syscall tracepoint can be opened without
permission to read raw kernel tracepoint data. Setting exclude_kernel
does not prevent its filter from running: perf_syscall_enter() submits
the saved user-mode registers.
Pointer-string filters use FILTER_PRED_FN_PCHAR by default, which reads
through strncpy_from_kernel_nofault(). For sys_enter_openat, for example,
the filename field comes directly from a syscall argument. An
unprivileged caller can pass a kernel address, install a filter such as
'filename ~ "Linux version*"', and use the event count to test the
contents of kernel memory, even with perf_event_paranoid=2.
Check the compiled filter before installing it and require the same
kernel and raw-tracepoint permissions as access to raw kernel tracepoint
data for FILTER_PRED_FN_PCHAR. Inspect every predicate so that other
events, operators, and boolean expressions cannot bypass the check.
Return the permission error through the existing cleanup path before
publishing the filter.
Keep user-pointer (.ustring) and record-local predicates available under
the existing policy. This leaves tracefs filtering and authorized kernel
string filtering unchanged.
Fixes: 5967bd5c4239 ("tracing: Let filter_assign_type() detect
FILTER_PTR_STRING")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <[email protected]>
---
kernel/trace/trace_events_filter.c | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/kernel/trace/trace_events_filter.c
b/kernel/trace/trace_events_filter.c
index 2b46ca536045..76aca560491b 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -2704,6 +2704,28 @@ static int ftrace_function_set_filter(struct perf_event
*event,
}
#endif /* CONFIG_FUNCTION_TRACER */
+static int ftrace_profile_filter_perm(struct event_filter *filter)
+{
+ struct prog_entry *prog = rcu_dereference_protected(filter->prog,
+ lockdep_is_held(&event_mutex));
+ int i, err;
+
+ for (i = 0; prog[i].pred; i++) {
+ if (prog[i].pred->fn_num != FILTER_PRED_FN_PCHAR)
+ continue;
+
+ /*
+ * Even a counting filter can reveal kernel string data.
+ * Require the same access as raw kernel tracepoints.
+ */
+ err = perf_allow_kernel();
+ if (err)
+ return err;
+ return perf_allow_tracepoint();
+ }
+ return 0;
+}
+
int ftrace_profile_set_filter(struct perf_event *event, int event_id,
char *filter_str)
{
@@ -2725,6 +2747,10 @@ int ftrace_profile_set_filter(struct perf_event *event,
int event_id,
if (err)
goto free_filter;
+ err = ftrace_profile_filter_perm(filter);
+ if (err)
+ goto free_filter;
+
if (ftrace_event_is_function(call))
err = ftrace_function_set_filter(event, filter);
else
base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab
--
2.53.0
