| Message ID | 89c7ff59d887a0360434e607bd625393ec3190e5.1611909025.git.saiprakash.ranjan@codeaurora.org |
|---|---|
| State | New |
| Headers | show |
| Series | Add support to exclude kernel mode hardware assisted instruction tracing | expand |
Hi Peter, On 2021-01-30 01:00, Peter Zijlstra wrote: > On Sat, Jan 30, 2021 at 12:35:10AM +0530, Sai Prakash Ranjan wrote: > >> Here the idea is to protect such important information from all users >> including root users since root privileges does not have to mean full >> control over the kernel [1] and root compromise does not have to be >> the end of the world. > > And yet, your thing lacks: > I guess you mean this lacks an explanation as to why this only applies to ITRACE and not others? See below. >> +config EXCLUDE_KERNEL_HW_ITRACE >> + bool "Exclude kernel mode hardware assisted instruction tracing" >> + depends on PERF_EVENTS > depends on SECURITY_LOCKDOWN > > or whatever the appropriate symbol is. > Ok I suppose you mean CONFIG_SECURITY_LOCKDOWN_LSM? But I don't see how this new config has to depend on that? This can work independently whether complete lockdown is enforced or not since it applies to only hardware instruction tracing. Ideally this depends on several hardware tracing configs such as ETMs and others but we don't need them because we are already exposing PERF_PMU_CAP_ITRACE check in the events core. >> + help >> + Exclude kernel mode instruction tracing by hardware tracing >> + family such as ARM Coresight ETM, Intel PT and so on. >> + >> + This option allows to disable kernel mode instruction tracing >> + offered by hardware assisted tracing for all users(including root) >> + especially for production systems where only userspace tracing >> might >> + be preferred for security reasons. > > Also, colour me unconvinced, pretty much all kernel level PMU usage > can be employed to side-channel / infer crypto keys, why focus on > ITRACE over others? Here ITRACE is not just instruction trace, it is meant for hardware assisted instruction trace such as Intel PT, Intel BTS, ARM coresight etc. These provide much more capabilities than normal instruction tracing whether its kernel level or userspace. More specifically, these provide more accurate branch trace like Intel PT LBR (Last Branch Record), Intel BTS(Branch Trace Store) which can be used to decode the program flow more accurately with timestamps in real time than other PMUs. Also there is cycle accurate tracing which can theoretically be used for some speculative execution based attacks. Which other kernel level PMUs can be used to get a full branch trace that is not locked down? If there is one, then this should probably be applied to it as well. Thanks, Sai -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation
On Mon, Feb 01, 2021 at 01:11:04PM +0530, Sai Prakash Ranjan wrote: > Ok I suppose you mean CONFIG_SECURITY_LOCKDOWN_LSM? But I don't see > how this new config has to depend on that? This can work independently > whether complete lockdown is enforced or not since it applies to only > hardware instruction tracing. Ideally this depends on several hardware > tracing configs such as ETMs and others but we don't need them because > we are already exposing PERF_PMU_CAP_ITRACE check in the events core. If you don't have lockdown, root pretty much owns the kernel, or am I missing something? > be used for some speculative execution based attacks. Which other > kernel level PMUs can be used to get a full branch trace that is not > locked down? If there is one, then this should probably be applied to > it as well. Just the regular counters. The information isn't as accurate, but given enough goes you can infer plenty. Just like all the SMT size-channel attacks. Sure, PT and friends make it even easier, but I don't see a fundamental distinction.
Hi Peter, On 2021-02-01 19:11, Peter Zijlstra wrote: > On Mon, Feb 01, 2021 at 01:11:04PM +0530, Sai Prakash Ranjan wrote: > >> Ok I suppose you mean CONFIG_SECURITY_LOCKDOWN_LSM? But I don't see >> how this new config has to depend on that? This can work independently >> whether complete lockdown is enforced or not since it applies to only >> hardware instruction tracing. Ideally this depends on several hardware >> tracing configs such as ETMs and others but we don't need them because >> we are already exposing PERF_PMU_CAP_ITRACE check in the events core. > > If you don't have lockdown, root pretty much owns the kernel, or am I > missing something? > You are right in saying that without lockdown root would own kernel but this config(EXCLUDE_KERNEL) will independently make sure that kernel level pmu tracing is not allowed(we return -EACCES) even if LOCKDOWN config is disabled. So I'm saying that we don't need to depend on LOCKDOWN config, its good to have LOCKDOWN config enabled but perf subsystem doesn't have to care about that. >> be used for some speculative execution based attacks. Which other >> kernel level PMUs can be used to get a full branch trace that is not >> locked down? If there is one, then this should probably be applied to >> it as well. > > Just the regular counters. The information isn't as accurate, but given > enough goes you can infer plenty. > > Just like all the SMT size-channel attacks. > > Sure, PT and friends make it even easier, but I don't see a fundamental > distinction. Right, we should then exclude all kernel level pmu tracing, is it fine? if (IS_ENABLED(CONFIG_EXCLUDE_KERNEL_HW_ITRACE) && !attr.exclude_kernel)) return -EACCES; Thanks, Sai -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation
Hi Peter, On 2021-02-02 11:41, Sai Prakash Ranjan wrote: > Hi Peter, > > On 2021-02-01 19:11, Peter Zijlstra wrote: >> On Mon, Feb 01, 2021 at 01:11:04PM +0530, Sai Prakash Ranjan wrote: >> >>> Ok I suppose you mean CONFIG_SECURITY_LOCKDOWN_LSM? But I don't see >>> how this new config has to depend on that? This can work >>> independently >>> whether complete lockdown is enforced or not since it applies to only >>> hardware instruction tracing. Ideally this depends on several >>> hardware >>> tracing configs such as ETMs and others but we don't need them >>> because >>> we are already exposing PERF_PMU_CAP_ITRACE check in the events core. >> >> If you don't have lockdown, root pretty much owns the kernel, or am I >> missing something? >> > > You are right in saying that without lockdown root would own kernel but > this config(EXCLUDE_KERNEL) will independently make sure that kernel > level pmu tracing is not allowed(we return -EACCES) even if LOCKDOWN > config is disabled. So I'm saying that we don't need to depend on > LOCKDOWN config, its good to have LOCKDOWN config enabled but perf > subsystem doesn't have to care about that. > >>> be used for some speculative execution based attacks. Which other >>> kernel level PMUs can be used to get a full branch trace that is not >>> locked down? If there is one, then this should probably be applied to >>> it as well. >> >> Just the regular counters. The information isn't as accurate, but >> given >> enough goes you can infer plenty. >> >> Just like all the SMT size-channel attacks. >> >> Sure, PT and friends make it even easier, but I don't see a >> fundamental >> distinction. > > Right, we should then exclude all kernel level pmu tracing, is it fine? > > if (IS_ENABLED(CONFIG_EXCLUDE_KERNEL_HW_ITRACE) && > !attr.exclude_kernel)) > return -EACCES; > Sorry for being pushy, but does the above make sense? Thanks, Sai -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, hosted by The Linux Foundation
diff --git a/init/Kconfig b/init/Kconfig index af454a51f3c5..31b4d1f26bce 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1832,6 +1832,18 @@ config DEBUG_PERF_USE_VMALLOC endmenu +config EXCLUDE_KERNEL_HW_ITRACE + bool "Exclude kernel mode hardware assisted instruction tracing" + depends on PERF_EVENTS + help + Exclude kernel mode instruction tracing by hardware tracing + family such as ARM Coresight ETM, Intel PT and so on. + + This option allows to disable kernel mode instruction tracing + offered by hardware assisted tracing for all users(including root) + especially for production systems where only userspace tracing might + be preferred for security reasons. + config VM_EVENT_COUNTERS default y bool "Enable VM event counters for /proc/vmstat" if EXPERT diff --git a/kernel/events/core.c b/kernel/events/core.c index aece2fe19693..044a774cef6d 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11866,6 +11866,12 @@ SYSCALL_DEFINE5(perf_event_open, goto err_task; } + if (IS_ENABLED(CONFIG_EXCLUDE_KERNEL_HW_ITRACE) && + (event->pmu->capabilities & PERF_PMU_CAP_ITRACE) && !attr.exclude_kernel) { + err = -EACCES; + goto err_alloc; + } + if (is_sampling_event(event)) { if (event->pmu->capabilities & PERF_PMU_CAP_NO_INTERRUPT) { err = -EOPNOTSUPP;