FROMLIST: security,perf: Allow further restriction of perf_event_open
When kernel.perf_event_open is set to 3 (or greater), disallow all
access to performance events by users without CAP_SYS_ADMIN.
Add a Kconfig symbol CONFIG_SECURITY_PERF_EVENTS_RESTRICT that
makes this value the default.
This is based on a similar feature in grsecurity
(CONFIG_GRKERNSEC_PERF_HARDEN). This version doesn't include making
the variable read-only. It also allows enabling further restriction
at run-time regardless of whether the default is changed.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Bug: 29054680
Patchset: perf-lockdown
(patch from https://lkml.org/lkml/2016/1/11/587)
Signed-off-by: Mattias Nissler <mnissler@google.com>
Change-Id: I2f2c625205358d68086c32e35b9ca814252786c4
4 files changed
