Loading...
1Overview
2========
3
4For general security related questions of perf_event_open() syscall usage,
5performance monitoring and observability operations by Perf see here:
6https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
7
8Enabling LSM based mandatory access control (MAC) to perf_event_open() syscall
9==============================================================================
10
11LSM hooks for mandatory access control for perf_event_open() syscall can be
12used starting from Linux v5.3. Below are the steps to extend Fedora (v31) with
13Targeted policy with perf_event_open() access control capabilities:
14
151. Download selinux-policy SRPM package (e.g. selinux-policy-3.14.4-48.fc31.src.rpm on FC31)
16 and install it so rpmbuild directory would exist in the current working directory:
17
18 # rpm -Uhv selinux-policy-3.14.4-48.fc31.src.rpm
19
202. Get into rpmbuild/SPECS directory and unpack the source code:
21
22 # rpmbuild -bp selinux-policy.spec
23
243. Place patch below at rpmbuild/BUILD/selinux-policy-b86eaaf4dbcf2d51dd4432df7185c0eaf3cbcc02
25 directory and apply it:
26
27 # patch -p1 < selinux-policy-perf-events-perfmon.patch
28 patching file policy/flask/access_vectors
29 patching file policy/flask/security_classes
30 # cat selinux-policy-perf-events-perfmon.patch
31diff -Nura a/policy/flask/access_vectors b/policy/flask/access_vectors
32--- a/policy/flask/access_vectors 2020-02-04 18:19:53.000000000 +0300
33+++ b/policy/flask/access_vectors 2020-02-28 23:37:25.000000000 +0300
34@@ -174,6 +174,7 @@
35 wake_alarm
36 block_suspend
37 audit_read
38+ perfmon
39 }
40
41 #
42@@ -1099,3 +1100,15 @@
43
44 class xdp_socket
45 inherits socket
46+
47+class perf_event
48+{
49+ open
50+ cpu
51+ kernel
52+ tracepoint
53+ read
54+ write
55+}
56+
57+
58diff -Nura a/policy/flask/security_classes b/policy/flask/security_classes
59--- a/policy/flask/security_classes 2020-02-04 18:19:53.000000000 +0300
60+++ b/policy/flask/security_classes 2020-02-28 21:35:17.000000000 +0300
61@@ -200,4 +200,6 @@
62
63 class xdp_socket
64
65+class perf_event
66+
67 # FLASK
68
694. Get into rpmbuild/SPECS directory and build policy packages from patched sources:
70
71 # rpmbuild --noclean --noprep -ba selinux-policy.spec
72
73 so you have this:
74
75 # ls -alh rpmbuild/RPMS/noarch/
76 total 33M
77 drwxr-xr-x. 2 root root 4.0K Mar 20 12:16 .
78 drwxr-xr-x. 3 root root 4.0K Mar 20 12:16 ..
79 -rw-r--r--. 1 root root 112K Mar 20 12:16 selinux-policy-3.14.4-48.fc31.noarch.rpm
80 -rw-r--r--. 1 root root 1.2M Mar 20 12:17 selinux-policy-devel-3.14.4-48.fc31.noarch.rpm
81 -rw-r--r--. 1 root root 2.3M Mar 20 12:17 selinux-policy-doc-3.14.4-48.fc31.noarch.rpm
82 -rw-r--r--. 1 root root 12M Mar 20 12:17 selinux-policy-minimum-3.14.4-48.fc31.noarch.rpm
83 -rw-r--r--. 1 root root 4.5M Mar 20 12:16 selinux-policy-mls-3.14.4-48.fc31.noarch.rpm
84 -rw-r--r--. 1 root root 111K Mar 20 12:16 selinux-policy-sandbox-3.14.4-48.fc31.noarch.rpm
85 -rw-r--r--. 1 root root 14M Mar 20 12:17 selinux-policy-targeted-3.14.4-48.fc31.noarch.rpm
86
875. Install SELinux packages from Fedora repo, if not already done so, and
88 update with the patched rpms above:
89
90 # rpm -Uhv rpmbuild/RPMS/noarch/selinux-policy-*
91
926. Enable SELinux Permissive mode for Targeted policy, if not already done so:
93
94 # cat /etc/selinux/config
95
96 # This file controls the state of SELinux on the system.
97 # SELINUX= can take one of these three values:
98 # enforcing - SELinux security policy is enforced.
99 # permissive - SELinux prints warnings instead of enforcing.
100 # disabled - No SELinux policy is loaded.
101 SELINUX=permissive
102 # SELINUXTYPE= can take one of these three values:
103 # targeted - Targeted processes are protected,
104 # minimum - Modification of targeted policy. Only selected processes are protected.
105 # mls - Multi Level Security protection.
106 SELINUXTYPE=targeted
107
1087. Enable filesystem SELinux labeling at the next reboot:
109
110 # touch /.autorelabel
111
1128. Reboot machine and it will label filesystems and load Targeted policy into the kernel;
113
1149. Login and check that dmesg output doesn't mention that perf_event class is unknown to SELinux subsystem;
115
11610. Check that SELinux is enabled and in Permissive mode
117
118 # getenforce
119 Permissive
120
12111. Turn SELinux into Enforcing mode:
122
123 # setenforce 1
124 # getenforce
125 Enforcing
126
127Opening access to perf_event_open() syscall on Fedora with SELinux
128==================================================================
129
130Access to performance monitoring and observability operations by Perf
131can be limited for superuser or CAP_PERFMON or CAP_SYS_ADMIN privileged
132processes. MAC policy settings (e.g. SELinux) can be loaded into the kernel
133and prevent unauthorized access to perf_event_open() syscall. In such case
134Perf tool provides a message similar to the one below:
135
136 # perf stat
137 Error:
138 Access to performance monitoring and observability operations is limited.
139 Enforced MAC policy settings (SELinux) can limit access to performance
140 monitoring and observability operations. Inspect system audit records for
141 more perf_event access control information and adjusting the policy.
142 Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
143 access to performance monitoring and observability operations for users
144 without CAP_PERFMON or CAP_SYS_ADMIN Linux capability.
145 perf_event_paranoid setting is -1:
146 -1: Allow use of (almost) all events by all users
147 Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
148 >= 0: Disallow raw and ftrace function tracepoint access
149 >= 1: Disallow CPU event access
150 >= 2: Disallow kernel profiling
151 To make the adjusted perf_event_paranoid setting permanent preserve it
152 in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
153
154To make sure that access is limited by MAC policy settings inspect system
155audit records using journalctl command or /var/log/audit/audit.log so the
156output would contain AVC denied records related to perf_event:
157
158 # journalctl --reverse --no-pager | grep perf_event
159
160 python3[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t.
161 If you believe that perf should be allowed open access on perf_event labeled unconfined_t by default.
162 setroubleshoot[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t. For complete SELinux messages run: sealert -l 4595ce5b-e58f-462c-9d86-3bc2074935de
163 audit[1318098]: AVC avc: denied { open } for pid=1318098 comm="perf" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=perf_event permissive=0
164
165In order to open access to perf_event_open() syscall MAC policy settings can
166require to be extended. On SELinux system this can be done by loading a special
167policy module extending base policy settings. Perf related policy module can
168be generated using the system audit records about blocking perf_event access.
169Run the command below to generate my-perf.te policy extension file with
170perf_event related rules:
171
172 # ausearch -c 'perf' --raw | audit2allow -M my-perf && cat my-perf.te
173
174 module my-perf 1.0;
175
176 require {
177 type unconfined_t;
178 class perf_event { cpu kernel open read tracepoint write };
179 }
180
181 #============= unconfined_t ==============
182 allow unconfined_t self:perf_event { cpu kernel open read tracepoint write };
183
184Now compile, pack and load my-perf.pp extension module into the kernel:
185
186 # checkmodule -M -m -o my-perf.mod my-perf.te
187 # semodule_package -o my-perf.pp -m my-perf.mod
188 # semodule -X 300 -i my-perf.pp
189
190After all those taken steps above access to perf_event_open() syscall should
191now be allowed by the policy settings. Check access running Perf like this:
192
193 # perf stat
194 ^C
195 Performance counter stats for 'system wide':
196
197 36,387.41 msec cpu-clock # 7.999 CPUs utilized
198 2,629 context-switches # 0.072 K/sec
199 57 cpu-migrations # 0.002 K/sec
200 1 page-faults # 0.000 K/sec
201 263,721,559 cycles # 0.007 GHz
202 175,746,713 instructions # 0.67 insn per cycle
203 19,628,798 branches # 0.539 M/sec
204 1,259,201 branch-misses # 6.42% of all branches
205
206 4.549061439 seconds time elapsed
207
208The generated perf-event.pp related policy extension module can be removed
209from the kernel using this command:
210
211 # semodule -X 300 -r my-perf
212
213Alternatively the module can be temporarily disabled and enabled back using
214these two commands:
215
216 # semodule -d my-perf
217 # semodule -e my-perf
218
219If something went wrong
220=======================
221
222To turn SELinux into Permissive mode:
223 # setenforce 0
224
225To fully disable SELinux during kernel boot [3] set kernel command line parameter selinux=0
226
227To remove SELinux labeling from local filesystems:
228 # find / -mount -print0 | xargs -0 setfattr -h -x security.selinux
229
230To fully turn SELinux off a machine set SELINUX=disabled at /etc/selinux/config file and reboot;
231
232Links
233=====
234
235[1] https://download-ib01.fedoraproject.org/pub/fedora/linux/updates/31/Everything/SRPMS/Packages/s/selinux-policy-3.14.4-49.fc31.src.rpm
236[2] https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux.html
237[3] https://danwalsh.livejournal.com/10972.html
1Overview
2========
3
4For general security related questions of perf_event_open() syscall usage,
5performance monitoring and observability operations by Perf see here:
6https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
7
8Enabling LSM based mandatory access control (MAC) to perf_event_open() syscall
9==============================================================================
10
11LSM hooks for mandatory access control for perf_event_open() syscall can be
12used starting from Linux v5.3. Below are the steps to extend Fedora (v31) with
13Targeted policy with perf_event_open() access control capabilities:
14
151. Download selinux-policy SRPM package (e.g. selinux-policy-3.14.4-48.fc31.src.rpm on FC31)
16 and install it so rpmbuild directory would exist in the current working directory:
17
18 # rpm -Uhv selinux-policy-3.14.4-48.fc31.src.rpm
19
202. Get into rpmbuild/SPECS directory and unpack the source code:
21
22 # rpmbuild -bp selinux-policy.spec
23
243. Place patch below at rpmbuild/BUILD/selinux-policy-b86eaaf4dbcf2d51dd4432df7185c0eaf3cbcc02
25 directory and apply it:
26
27 # patch -p1 < selinux-policy-perf-events-perfmon.patch
28 patching file policy/flask/access_vectors
29 patching file policy/flask/security_classes
30 # cat selinux-policy-perf-events-perfmon.patch
31diff -Nura a/policy/flask/access_vectors b/policy/flask/access_vectors
32--- a/policy/flask/access_vectors 2020-02-04 18:19:53.000000000 +0300
33+++ b/policy/flask/access_vectors 2020-02-28 23:37:25.000000000 +0300
34@@ -174,6 +174,7 @@
35 wake_alarm
36 block_suspend
37 audit_read
38+ perfmon
39 }
40
41 #
42@@ -1099,3 +1100,15 @@
43
44 class xdp_socket
45 inherits socket
46+
47+class perf_event
48+{
49+ open
50+ cpu
51+ kernel
52+ tracepoint
53+ read
54+ write
55+}
56+
57+
58diff -Nura a/policy/flask/security_classes b/policy/flask/security_classes
59--- a/policy/flask/security_classes 2020-02-04 18:19:53.000000000 +0300
60+++ b/policy/flask/security_classes 2020-02-28 21:35:17.000000000 +0300
61@@ -200,4 +200,6 @@
62
63 class xdp_socket
64
65+class perf_event
66+
67 # FLASK
68
694. Get into rpmbuild/SPECS directory and build policy packages from patched sources:
70
71 # rpmbuild --noclean --noprep -ba selinux-policy.spec
72
73 so you have this:
74
75 # ls -alh rpmbuild/RPMS/noarch/
76 total 33M
77 drwxr-xr-x. 2 root root 4.0K Mar 20 12:16 .
78 drwxr-xr-x. 3 root root 4.0K Mar 20 12:16 ..
79 -rw-r--r--. 1 root root 112K Mar 20 12:16 selinux-policy-3.14.4-48.fc31.noarch.rpm
80 -rw-r--r--. 1 root root 1.2M Mar 20 12:17 selinux-policy-devel-3.14.4-48.fc31.noarch.rpm
81 -rw-r--r--. 1 root root 2.3M Mar 20 12:17 selinux-policy-doc-3.14.4-48.fc31.noarch.rpm
82 -rw-r--r--. 1 root root 12M Mar 20 12:17 selinux-policy-minimum-3.14.4-48.fc31.noarch.rpm
83 -rw-r--r--. 1 root root 4.5M Mar 20 12:16 selinux-policy-mls-3.14.4-48.fc31.noarch.rpm
84 -rw-r--r--. 1 root root 111K Mar 20 12:16 selinux-policy-sandbox-3.14.4-48.fc31.noarch.rpm
85 -rw-r--r--. 1 root root 14M Mar 20 12:17 selinux-policy-targeted-3.14.4-48.fc31.noarch.rpm
86
875. Install SELinux packages from Fedora repo, if not already done so, and
88 update with the patched rpms above:
89
90 # rpm -Uhv rpmbuild/RPMS/noarch/selinux-policy-*
91
926. Enable SELinux Permissive mode for Targeted policy, if not already done so:
93
94 # cat /etc/selinux/config
95
96 # This file controls the state of SELinux on the system.
97 # SELINUX= can take one of these three values:
98 # enforcing - SELinux security policy is enforced.
99 # permissive - SELinux prints warnings instead of enforcing.
100 # disabled - No SELinux policy is loaded.
101 SELINUX=permissive
102 # SELINUXTYPE= can take one of these three values:
103 # targeted - Targeted processes are protected,
104 # minimum - Modification of targeted policy. Only selected processes are protected.
105 # mls - Multi Level Security protection.
106 SELINUXTYPE=targeted
107
1087. Enable filesystem SELinux labeling at the next reboot:
109
110 # touch /.autorelabel
111
1128. Reboot machine and it will label filesystems and load Targeted policy into the kernel;
113
1149. Login and check that dmesg output doesn't mention that perf_event class is unknown to SELinux subsystem;
115
11610. Check that SELinux is enabled and in Permissive mode
117
118 # getenforce
119 Permissive
120
12111. Turn SELinux into Enforcing mode:
122
123 # setenforce 1
124 # getenforce
125 Enforcing
126
127Opening access to perf_event_open() syscall on Fedora with SELinux
128==================================================================
129
130Access to performance monitoring and observability operations by Perf
131can be limited for superuser or CAP_PERFMON or CAP_SYS_ADMIN privileged
132processes. MAC policy settings (e.g. SELinux) can be loaded into the kernel
133and prevent unauthorized access to perf_event_open() syscall. In such case
134Perf tool provides a message similar to the one below:
135
136 # perf stat
137 Error:
138 Access to performance monitoring and observability operations is limited.
139 Enforced MAC policy settings (SELinux) can limit access to performance
140 monitoring and observability operations. Inspect system audit records for
141 more perf_event access control information and adjusting the policy.
142 Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
143 access to performance monitoring and observability operations for users
144 without CAP_PERFMON or CAP_SYS_ADMIN Linux capability.
145 perf_event_paranoid setting is -1:
146 -1: Allow use of (almost) all events by all users
147 Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
148 >= 0: Disallow raw and ftrace function tracepoint access
149 >= 1: Disallow CPU event access
150 >= 2: Disallow kernel profiling
151 To make the adjusted perf_event_paranoid setting permanent preserve it
152 in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
153
154To make sure that access is limited by MAC policy settings inspect system
155audit records using journalctl command or /var/log/audit/audit.log so the
156output would contain AVC denied records related to perf_event:
157
158 # journalctl --reverse --no-pager | grep perf_event
159
160 python3[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t.
161 If you believe that perf should be allowed open access on perf_event labeled unconfined_t by default.
162 setroubleshoot[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t. For complete SELinux messages run: sealert -l 4595ce5b-e58f-462c-9d86-3bc2074935de
163 audit[1318098]: AVC avc: denied { open } for pid=1318098 comm="perf" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=perf_event permissive=0
164
165In order to open access to perf_event_open() syscall MAC policy settings can
166require to be extended. On SELinux system this can be done by loading a special
167policy module extending base policy settings. Perf related policy module can
168be generated using the system audit records about blocking perf_event access.
169Run the command below to generate my-perf.te policy extension file with
170perf_event related rules:
171
172 # ausearch -c 'perf' --raw | audit2allow -M my-perf && cat my-perf.te
173
174 module my-perf 1.0;
175
176 require {
177 type unconfined_t;
178 class perf_event { cpu kernel open read tracepoint write };
179 }
180
181 #============= unconfined_t ==============
182 allow unconfined_t self:perf_event { cpu kernel open read tracepoint write };
183
184Now compile, pack and load my-perf.pp extension module into the kernel:
185
186 # checkmodule -M -m -o my-perf.mod my-perf.te
187 # semodule_package -o my-perf.pp -m my-perf.mod
188 # semodule -X 300 -i my-perf.pp
189
190After all those taken steps above access to perf_event_open() syscall should
191now be allowed by the policy settings. Check access running Perf like this:
192
193 # perf stat
194 ^C
195 Performance counter stats for 'system wide':
196
197 36,387.41 msec cpu-clock # 7.999 CPUs utilized
198 2,629 context-switches # 0.072 K/sec
199 57 cpu-migrations # 0.002 K/sec
200 1 page-faults # 0.000 K/sec
201 263,721,559 cycles # 0.007 GHz
202 175,746,713 instructions # 0.67 insn per cycle
203 19,628,798 branches # 0.539 M/sec
204 1,259,201 branch-misses # 6.42% of all branches
205
206 4.549061439 seconds time elapsed
207
208The generated perf-event.pp related policy extension module can be removed
209from the kernel using this command:
210
211 # semodule -X 300 -r my-perf
212
213Alternatively the module can be temporarily disabled and enabled back using
214these two commands:
215
216 # semodule -d my-perf
217 # semodule -e my-perf
218
219If something went wrong
220=======================
221
222To turn SELinux into Permissive mode:
223 # setenforce 0
224
225To fully disable SELinux during kernel boot [3] set kernel command line parameter selinux=0
226
227To remove SELinux labeling from local filesystems:
228 # find / -mount -print0 | xargs -0 setfattr -h -x security.selinux
229
230To fully turn SELinux off a machine set SELINUX=disabled at /etc/selinux/config file and reboot;
231
232Links
233=====
234
235[1] https://download-ib01.fedoraproject.org/pub/fedora/linux/updates/31/Everything/SRPMS/Packages/s/selinux-policy-3.14.4-49.fc31.src.rpm
236[2] https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux.html
237[3] https://danwalsh.livejournal.com/10972.html