security.txt 9.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237
  1. Overview
  2. ========
  3. For general security related questions of perf_event_open() syscall usage,
  4. performance monitoring and observability operations by Perf see here:
  5. https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
  6. Enabling LSM based mandatory access control (MAC) to perf_event_open() syscall
  7. ==============================================================================
  8. LSM hooks for mandatory access control for perf_event_open() syscall can be
  9. used starting from Linux v5.3. Below are the steps to extend Fedora (v31) with
  10. Targeted policy with perf_event_open() access control capabilities:
  11. 1. Download selinux-policy SRPM package (e.g. selinux-policy-3.14.4-48.fc31.src.rpm on FC31)
  12. and install it so rpmbuild directory would exist in the current working directory:
  13. # rpm -Uhv selinux-policy-3.14.4-48.fc31.src.rpm
  14. 2. Get into rpmbuild/SPECS directory and unpack the source code:
  15. # rpmbuild -bp selinux-policy.spec
  16. 3. Place patch below at rpmbuild/BUILD/selinux-policy-b86eaaf4dbcf2d51dd4432df7185c0eaf3cbcc02
  17. directory and apply it:
  18. # patch -p1 < selinux-policy-perf-events-perfmon.patch
  19. patching file policy/flask/access_vectors
  20. patching file policy/flask/security_classes
  21. # cat selinux-policy-perf-events-perfmon.patch
  22. diff -Nura a/policy/flask/access_vectors b/policy/flask/access_vectors
  23. --- a/policy/flask/access_vectors 2020-02-04 18:19:53.000000000 +0300
  24. +++ b/policy/flask/access_vectors 2020-02-28 23:37:25.000000000 +0300
  25. @@ -174,6 +174,7 @@
  26. wake_alarm
  27. block_suspend
  28. audit_read
  29. + perfmon
  30. }
  31. #
  32. @@ -1099,3 +1100,15 @@
  33. class xdp_socket
  34. inherits socket
  35. +
  36. +class perf_event
  37. +{
  38. + open
  39. + cpu
  40. + kernel
  41. + tracepoint
  42. + read
  43. + write
  44. +}
  45. +
  46. +
  47. diff -Nura a/policy/flask/security_classes b/policy/flask/security_classes
  48. --- a/policy/flask/security_classes 2020-02-04 18:19:53.000000000 +0300
  49. +++ b/policy/flask/security_classes 2020-02-28 21:35:17.000000000 +0300
  50. @@ -200,4 +200,6 @@
  51. class xdp_socket
  52. +class perf_event
  53. +
  54. # FLASK
  55. 4. Get into rpmbuild/SPECS directory and build policy packages from patched sources:
  56. # rpmbuild --noclean --noprep -ba selinux-policy.spec
  57. so you have this:
  58. # ls -alh rpmbuild/RPMS/noarch/
  59. total 33M
  60. drwxr-xr-x. 2 root root 4.0K Mar 20 12:16 .
  61. drwxr-xr-x. 3 root root 4.0K Mar 20 12:16 ..
  62. -rw-r--r--. 1 root root 112K Mar 20 12:16 selinux-policy-3.14.4-48.fc31.noarch.rpm
  63. -rw-r--r--. 1 root root 1.2M Mar 20 12:17 selinux-policy-devel-3.14.4-48.fc31.noarch.rpm
  64. -rw-r--r--. 1 root root 2.3M Mar 20 12:17 selinux-policy-doc-3.14.4-48.fc31.noarch.rpm
  65. -rw-r--r--. 1 root root 12M Mar 20 12:17 selinux-policy-minimum-3.14.4-48.fc31.noarch.rpm
  66. -rw-r--r--. 1 root root 4.5M Mar 20 12:16 selinux-policy-mls-3.14.4-48.fc31.noarch.rpm
  67. -rw-r--r--. 1 root root 111K Mar 20 12:16 selinux-policy-sandbox-3.14.4-48.fc31.noarch.rpm
  68. -rw-r--r--. 1 root root 14M Mar 20 12:17 selinux-policy-targeted-3.14.4-48.fc31.noarch.rpm
  69. 5. Install SELinux packages from Fedora repo, if not already done so, and
  70. update with the patched rpms above:
  71. # rpm -Uhv rpmbuild/RPMS/noarch/selinux-policy-*
  72. 6. Enable SELinux Permissive mode for Targeted policy, if not already done so:
  73. # cat /etc/selinux/config
  74. # This file controls the state of SELinux on the system.
  75. # SELINUX= can take one of these three values:
  76. # enforcing - SELinux security policy is enforced.
  77. # permissive - SELinux prints warnings instead of enforcing.
  78. # disabled - No SELinux policy is loaded.
  79. SELINUX=permissive
  80. # SELINUXTYPE= can take one of these three values:
  81. # targeted - Targeted processes are protected,
  82. # minimum - Modification of targeted policy. Only selected processes are protected.
  83. # mls - Multi Level Security protection.
  84. SELINUXTYPE=targeted
  85. 7. Enable filesystem SELinux labeling at the next reboot:
  86. # touch /.autorelabel
  87. 8. Reboot machine and it will label filesystems and load Targeted policy into the kernel;
  88. 9. Login and check that dmesg output doesn't mention that perf_event class is unknown to SELinux subsystem;
  89. 10. Check that SELinux is enabled and in Permissive mode
  90. # getenforce
  91. Permissive
  92. 11. Turn SELinux into Enforcing mode:
  93. # setenforce 1
  94. # getenforce
  95. Enforcing
  96. Opening access to perf_event_open() syscall on Fedora with SELinux
  97. ==================================================================
  98. Access to performance monitoring and observability operations by Perf
  99. can be limited for superuser or CAP_PERFMON or CAP_SYS_ADMIN privileged
  100. processes. MAC policy settings (e.g. SELinux) can be loaded into the kernel
  101. and prevent unauthorized access to perf_event_open() syscall. In such case
  102. Perf tool provides a message similar to the one below:
  103. # perf stat
  104. Error:
  105. Access to performance monitoring and observability operations is limited.
  106. Enforced MAC policy settings (SELinux) can limit access to performance
  107. monitoring and observability operations. Inspect system audit records for
  108. more perf_event access control information and adjusting the policy.
  109. Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
  110. access to performance monitoring and observability operations for users
  111. without CAP_PERFMON or CAP_SYS_ADMIN Linux capability.
  112. perf_event_paranoid setting is -1:
  113. -1: Allow use of (almost) all events by all users
  114. Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
  115. >= 0: Disallow raw and ftrace function tracepoint access
  116. >= 1: Disallow CPU event access
  117. >= 2: Disallow kernel profiling
  118. To make the adjusted perf_event_paranoid setting permanent preserve it
  119. in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
  120. To make sure that access is limited by MAC policy settings inspect system
  121. audit records using journalctl command or /var/log/audit/audit.log so the
  122. output would contain AVC denied records related to perf_event:
  123. # journalctl --reverse --no-pager | grep perf_event
  124. python3[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t.
  125. If you believe that perf should be allowed open access on perf_event labeled unconfined_t by default.
  126. setroubleshoot[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t. For complete SELinux messages run: sealert -l 4595ce5b-e58f-462c-9d86-3bc2074935de
  127. audit[1318098]: AVC avc: denied { open } for pid=1318098 comm="perf" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=perf_event permissive=0
  128. In order to open access to perf_event_open() syscall MAC policy settings can
  129. require to be extended. On SELinux system this can be done by loading a special
  130. policy module extending base policy settings. Perf related policy module can
  131. be generated using the system audit records about blocking perf_event access.
  132. Run the command below to generate my-perf.te policy extension file with
  133. perf_event related rules:
  134. # ausearch -c 'perf' --raw | audit2allow -M my-perf && cat my-perf.te
  135. module my-perf 1.0;
  136. require {
  137. type unconfined_t;
  138. class perf_event { cpu kernel open read tracepoint write };
  139. }
  140. #============= unconfined_t ==============
  141. allow unconfined_t self:perf_event { cpu kernel open read tracepoint write };
  142. Now compile, pack and load my-perf.pp extension module into the kernel:
  143. # checkmodule -M -m -o my-perf.mod my-perf.te
  144. # semodule_package -o my-perf.pp -m my-perf.mod
  145. # semodule -X 300 -i my-perf.pp
  146. After all those taken steps above access to perf_event_open() syscall should
  147. now be allowed by the policy settings. Check access running Perf like this:
  148. # perf stat
  149. ^C
  150. Performance counter stats for 'system wide':
  151. 36,387.41 msec cpu-clock # 7.999 CPUs utilized
  152. 2,629 context-switches # 0.072 K/sec
  153. 57 cpu-migrations # 0.002 K/sec
  154. 1 page-faults # 0.000 K/sec
  155. 263,721,559 cycles # 0.007 GHz
  156. 175,746,713 instructions # 0.67 insn per cycle
  157. 19,628,798 branches # 0.539 M/sec
  158. 1,259,201 branch-misses # 6.42% of all branches
  159. 4.549061439 seconds time elapsed
  160. The generated perf-event.pp related policy extension module can be removed
  161. from the kernel using this command:
  162. # semodule -X 300 -r my-perf
  163. Alternatively the module can be temporarily disabled and enabled back using
  164. these two commands:
  165. # semodule -d my-perf
  166. # semodule -e my-perf
  167. If something went wrong
  168. =======================
  169. To turn SELinux into Permissive mode:
  170. # setenforce 0
  171. To fully disable SELinux during kernel boot [3] set kernel command line parameter selinux=0
  172. To remove SELinux labeling from local filesystems:
  173. # find / -mount -print0 | xargs -0 setfattr -h -x security.selinux
  174. To fully turn SELinux off a machine set SELINUX=disabled at /etc/selinux/config file and reboot;
  175. Links
  176. =====
  177. [1] https://download-ib01.fedoraproject.org/pub/fedora/linux/updates/31/Everything/SRPMS/Packages/s/selinux-policy-3.14.4-49.fc31.src.rpm
  178. [2] https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux.html
  179. [3] https://danwalsh.livejournal.com/10972.html