123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237 |
- Overview
- ========
- For general security related questions of perf_event_open() syscall usage,
- performance monitoring and observability operations by Perf see here:
- https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
- Enabling LSM based mandatory access control (MAC) to perf_event_open() syscall
- ==============================================================================
- LSM hooks for mandatory access control for perf_event_open() syscall can be
- used starting from Linux v5.3. Below are the steps to extend Fedora (v31) with
- Targeted policy with perf_event_open() access control capabilities:
- 1. Download selinux-policy SRPM package (e.g. selinux-policy-3.14.4-48.fc31.src.rpm on FC31)
- and install it so rpmbuild directory would exist in the current working directory:
- # rpm -Uhv selinux-policy-3.14.4-48.fc31.src.rpm
- 2. Get into rpmbuild/SPECS directory and unpack the source code:
- # rpmbuild -bp selinux-policy.spec
- 3. Place patch below at rpmbuild/BUILD/selinux-policy-b86eaaf4dbcf2d51dd4432df7185c0eaf3cbcc02
- directory and apply it:
- # patch -p1 < selinux-policy-perf-events-perfmon.patch
- patching file policy/flask/access_vectors
- patching file policy/flask/security_classes
- # cat selinux-policy-perf-events-perfmon.patch
- diff -Nura a/policy/flask/access_vectors b/policy/flask/access_vectors
- --- a/policy/flask/access_vectors 2020-02-04 18:19:53.000000000 +0300
- +++ b/policy/flask/access_vectors 2020-02-28 23:37:25.000000000 +0300
- @@ -174,6 +174,7 @@
- wake_alarm
- block_suspend
- audit_read
- + perfmon
- }
-
- #
- @@ -1099,3 +1100,15 @@
-
- class xdp_socket
- inherits socket
- +
- +class perf_event
- +{
- + open
- + cpu
- + kernel
- + tracepoint
- + read
- + write
- +}
- +
- +
- diff -Nura a/policy/flask/security_classes b/policy/flask/security_classes
- --- a/policy/flask/security_classes 2020-02-04 18:19:53.000000000 +0300
- +++ b/policy/flask/security_classes 2020-02-28 21:35:17.000000000 +0300
- @@ -200,4 +200,6 @@
-
- class xdp_socket
-
- +class perf_event
- +
- # FLASK
- 4. Get into rpmbuild/SPECS directory and build policy packages from patched sources:
- # rpmbuild --noclean --noprep -ba selinux-policy.spec
- so you have this:
- # ls -alh rpmbuild/RPMS/noarch/
- total 33M
- drwxr-xr-x. 2 root root 4.0K Mar 20 12:16 .
- drwxr-xr-x. 3 root root 4.0K Mar 20 12:16 ..
- -rw-r--r--. 1 root root 112K Mar 20 12:16 selinux-policy-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 1.2M Mar 20 12:17 selinux-policy-devel-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 2.3M Mar 20 12:17 selinux-policy-doc-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 12M Mar 20 12:17 selinux-policy-minimum-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 4.5M Mar 20 12:16 selinux-policy-mls-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 111K Mar 20 12:16 selinux-policy-sandbox-3.14.4-48.fc31.noarch.rpm
- -rw-r--r--. 1 root root 14M Mar 20 12:17 selinux-policy-targeted-3.14.4-48.fc31.noarch.rpm
- 5. Install SELinux packages from Fedora repo, if not already done so, and
- update with the patched rpms above:
- # rpm -Uhv rpmbuild/RPMS/noarch/selinux-policy-*
- 6. Enable SELinux Permissive mode for Targeted policy, if not already done so:
- # cat /etc/selinux/config
- # This file controls the state of SELinux on the system.
- # SELINUX= can take one of these three values:
- # enforcing - SELinux security policy is enforced.
- # permissive - SELinux prints warnings instead of enforcing.
- # disabled - No SELinux policy is loaded.
- SELINUX=permissive
- # SELINUXTYPE= can take one of these three values:
- # targeted - Targeted processes are protected,
- # minimum - Modification of targeted policy. Only selected processes are protected.
- # mls - Multi Level Security protection.
- SELINUXTYPE=targeted
- 7. Enable filesystem SELinux labeling at the next reboot:
- # touch /.autorelabel
- 8. Reboot machine and it will label filesystems and load Targeted policy into the kernel;
- 9. Login and check that dmesg output doesn't mention that perf_event class is unknown to SELinux subsystem;
- 10. Check that SELinux is enabled and in Permissive mode
- # getenforce
- Permissive
- 11. Turn SELinux into Enforcing mode:
- # setenforce 1
- # getenforce
- Enforcing
- Opening access to perf_event_open() syscall on Fedora with SELinux
- ==================================================================
- Access to performance monitoring and observability operations by Perf
- can be limited for superuser or CAP_PERFMON or CAP_SYS_ADMIN privileged
- processes. MAC policy settings (e.g. SELinux) can be loaded into the kernel
- and prevent unauthorized access to perf_event_open() syscall. In such case
- Perf tool provides a message similar to the one below:
- # perf stat
- Error:
- Access to performance monitoring and observability operations is limited.
- Enforced MAC policy settings (SELinux) can limit access to performance
- monitoring and observability operations. Inspect system audit records for
- more perf_event access control information and adjusting the policy.
- Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
- access to performance monitoring and observability operations for users
- without CAP_PERFMON or CAP_SYS_ADMIN Linux capability.
- perf_event_paranoid setting is -1:
- -1: Allow use of (almost) all events by all users
- Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
- >= 0: Disallow raw and ftrace function tracepoint access
- >= 1: Disallow CPU event access
- >= 2: Disallow kernel profiling
- To make the adjusted perf_event_paranoid setting permanent preserve it
- in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
- To make sure that access is limited by MAC policy settings inspect system
- audit records using journalctl command or /var/log/audit/audit.log so the
- output would contain AVC denied records related to perf_event:
- # journalctl --reverse --no-pager | grep perf_event
- python3[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t.
- If you believe that perf should be allowed open access on perf_event labeled unconfined_t by default.
- setroubleshoot[1318099]: SELinux is preventing perf from open access on the perf_event labeled unconfined_t. For complete SELinux messages run: sealert -l 4595ce5b-e58f-462c-9d86-3bc2074935de
- audit[1318098]: AVC avc: denied { open } for pid=1318098 comm="perf" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=perf_event permissive=0
- In order to open access to perf_event_open() syscall MAC policy settings can
- require to be extended. On SELinux system this can be done by loading a special
- policy module extending base policy settings. Perf related policy module can
- be generated using the system audit records about blocking perf_event access.
- Run the command below to generate my-perf.te policy extension file with
- perf_event related rules:
- # ausearch -c 'perf' --raw | audit2allow -M my-perf && cat my-perf.te
- module my-perf 1.0;
- require {
- type unconfined_t;
- class perf_event { cpu kernel open read tracepoint write };
- }
- #============= unconfined_t ==============
- allow unconfined_t self:perf_event { cpu kernel open read tracepoint write };
- Now compile, pack and load my-perf.pp extension module into the kernel:
- # checkmodule -M -m -o my-perf.mod my-perf.te
- # semodule_package -o my-perf.pp -m my-perf.mod
- # semodule -X 300 -i my-perf.pp
- After all those taken steps above access to perf_event_open() syscall should
- now be allowed by the policy settings. Check access running Perf like this:
- # perf stat
- ^C
- Performance counter stats for 'system wide':
- 36,387.41 msec cpu-clock # 7.999 CPUs utilized
- 2,629 context-switches # 0.072 K/sec
- 57 cpu-migrations # 0.002 K/sec
- 1 page-faults # 0.000 K/sec
- 263,721,559 cycles # 0.007 GHz
- 175,746,713 instructions # 0.67 insn per cycle
- 19,628,798 branches # 0.539 M/sec
- 1,259,201 branch-misses # 6.42% of all branches
- 4.549061439 seconds time elapsed
- The generated perf-event.pp related policy extension module can be removed
- from the kernel using this command:
- # semodule -X 300 -r my-perf
- Alternatively the module can be temporarily disabled and enabled back using
- these two commands:
- # semodule -d my-perf
- # semodule -e my-perf
- If something went wrong
- =======================
- To turn SELinux into Permissive mode:
- # setenforce 0
- To fully disable SELinux during kernel boot [3] set kernel command line parameter selinux=0
- To remove SELinux labeling from local filesystems:
- # find / -mount -print0 | xargs -0 setfattr -h -x security.selinux
- To fully turn SELinux off a machine set SELINUX=disabled at /etc/selinux/config file and reboot;
- Links
- =====
- [1] https://download-ib01.fedoraproject.org/pub/fedora/linux/updates/31/Everything/SRPMS/Packages/s/selinux-policy-3.14.4-49.fc31.src.rpm
- [2] https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-Enabling_and_Disabling_SELinux.html
- [3] https://danwalsh.livejournal.com/10972.html
|