Re: [PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-16 Thread Peter Zijlstra
On Tue, Oct 15, 2019 at 08:35:00PM -0400, Joel Fernandes wrote: > Peter, if you are Ok with it, could you squash the below diff into my > original patch? But let me know if you want me to resend the whole patch > again. Thanks. Folded thanks! I had assumed it was required such that

Re: [PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-15 Thread Joel Fernandes
> > diff --git a/include/uapi/linux/perf_event.h > > b/include/uapi/linux/perf_event.h > > index bb7b271397a6..2af95f937a5b 100644 > > --- a/include/uapi/linux/perf_event.h > > +++ b/include/uapi/linux/perf_event.h > > @@ -427,6 +427,15 @@ struct perf_event_attr { > > __u16 __reserved_2;

Re: [PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-15 Thread Joel Fernandes
On Tue, Oct 15, 2019 at 10:30:08AM +0200, Peter Zijlstra wrote: > On Mon, Oct 14, 2019 at 01:03:08PM -0400, Joel Fernandes (Google) wrote: > > In current mainline, the degree of access to perf_event_open(2) system > > call depends on the perf_event_paranoid sysctl. This has a number of > >

Re: [PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-15 Thread Stephen Smalley
On 10/14/19 1:03 PM, Joel Fernandes (Google) wrote: In current mainline, the degree of access to perf_event_open(2) system call depends on the perf_event_paranoid sysctl. This has a number of limitations: 1. The sysctl is only a single value. Many types of accesses are controlled based on

Re: [PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-15 Thread Peter Zijlstra
On Mon, Oct 14, 2019 at 01:03:08PM -0400, Joel Fernandes (Google) wrote: > In current mainline, the degree of access to perf_event_open(2) system > call depends on the perf_event_paranoid sysctl. This has a number of > limitations: > > 1. The sysctl is only a single value. Many types of accesses

[PATCH v2] perf_event: Add support for LSM and SELinux checks

2019-10-14 Thread Joel Fernandes (Google)
In current mainline, the degree of access to perf_event_open(2) system call depends on the perf_event_paranoid sysctl. This has a number of limitations: 1. The sysctl is only a single value. Many types of accesses are controlled based on the single value thus making the control very limited