tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

doc/admin-guide: update kernel.rst with CAP_PERFMON information

Update the kernel.rst documentation file with the information related to
usage of CAP_PERFMON capability to secure performance monitoring and
observability operations in system.

Signed-off-by: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Igor Lubashev <ilubashe@akamai.com>
Cc: James Morris <jmorris@namei.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Serge Hallyn <serge@hallyn.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: intel-gfx@lists.freedesktop.org
Cc: linux-doc@vger.kernel.org
Cc: linux-man@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Cc: selinux@vger.kernel.org
Link: http://lore.kernel.org/lkml/84c32383-14a2-fa35-16b6-f9e59bd37240@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

authored by

Alexey Budankov and committed by
Arnaldo Carvalho de Melo 025b16f8 902a8dcc

+11 -5
+11 -5
Documentation/admin-guide/sysctl/kernel.rst
··· 730 730 =================== 731 731 732 732 Controls use of the performance events system by unprivileged 733 - users (without CAP_SYS_ADMIN). The default value is 2. 733 + users (without CAP_PERFMON). The default value is 2. 734 + 735 + For backward compatibility reasons access to system performance 736 + monitoring and observability remains open for CAP_SYS_ADMIN 737 + privileged processes but CAP_SYS_ADMIN usage for secure system 738 + performance monitoring and observability operations is discouraged 739 + with respect to CAP_PERFMON use cases. 734 740 735 741 === ================================================================== 736 742 -1 Allow use of (almost) all events by all users. ··· 745 739 ``CAP_IPC_LOCK``. 746 740 747 741 >=0 Disallow ftrace function tracepoint by users without 748 - ``CAP_SYS_ADMIN``. 742 + ``CAP_PERFMON``. 749 743 750 - Disallow raw tracepoint access by users without ``CAP_SYS_ADMIN``. 744 + Disallow raw tracepoint access by users without ``CAP_PERFMON``. 751 745 752 - >=1 Disallow CPU event access by users without ``CAP_SYS_ADMIN``. 746 + >=1 Disallow CPU event access by users without ``CAP_PERFMON``. 753 747 754 - >=2 Disallow kernel profiling by users without ``CAP_SYS_ADMIN``. 748 + >=2 Disallow kernel profiling by users without ``CAP_PERFMON``. 755 749 === ================================================================== 756 750 757 751