Documentation/admin-guide/perf-security.rst

9 Usage of Performance Counters for Linux (perf_events) [1]_ , [2]_ , [3]_
12 direct usage of perf_events system call API [2]_ and over data files
13 generated by Perf tool user mode utility (Perf) [3]_ , [4]_ . The risk
15 units (PMU) [2]_ and Perf collect and expose for performance analysis.
31    (PMC) [8]_ and machine specific registers (MSR) [9]_ that provide
47 the subject for security access control management [5]_ .
53 into two categories [6]_ : a) privileged processes (whose effective user
61 based on the process's credentials [5]_ (usually: effective UID,
65 into distinct units, known as capabilities [6]_ , which can be
73 privilege [13]_ (POSIX 1003.1e: 2.2.2.39) for performance monitoring and
81 If system audit records [14]_ for a process using perf_events system call
88 for PTRACE_MODE_READ_REALCREDS ptrace access mode check [7]_ , whose
102 Mechanisms of capabilities, privileged capability-dumb files [6]_ and
103 file system ACLs [10]_ can be used to create dedicated groups of
126    privileges [6]_ :
163 or root running processes with CAP_SETPCAP, CAP_SETFCAP [6]_
170 is governed by perf_event_paranoid [2]_ setting:
174      performance monitoring. Per-user per-cpu perf_event_mlock_kb [2]_
187      [6]_ capability.
210 The perf_events system call API [2]_ allocates file descriptors for
212 accountable resource governed by the RLIMIT_NOFILE [11]_ limit
217 modifying content of the limits.conf file [12]_ . Ordinarily, a Perf
226 performance monitoring data is governed by the perf_event_mlock_kb [2]_
230 RLIMIT_MEMLOCK [11]_ limit, but only for memory regions mapped
253 .. [1] `<https://lwn.net/Articles/337493/>`_
254 .. [2] `<http://man7.org/linux/man-pages/man2/perf_event_open.2.html>`_
255 .. [3] `<http://web.eece.maine.edu/~vweaver/projects/perf_events/>`_
256 .. [4] `<https://perf.wiki.kernel.org/index.php/Main_Page>`_
257 .. [5] `<https://www.kernel.org/doc/html/latest/security/credentials.html>`_
258 .. [6] `<http://man7.org/linux/man-pages/man7/capabilities.7.html>`_
259 .. [7] `<http://man7.org/linux/man-pages/man2/ptrace.2.html>`_
260 .. [8] `<https://en.wikipedia.org/wiki/Hardware_performance_counter>`_
261 .. [9] `<https://en.wikipedia.org/wiki/Model-specific_register>`_
262 .. [10] `<http://man7.org/linux/man-pages/man5/acl.5.html>`_
263 .. [11] `<http://man7.org/linux/man-pages/man2/getrlimit.2.html>`_
264 .. [12] `<http://man7.org/linux/man-pages/man5/limits.conf.5.html>`_
265 .. [13] `<https://sites.google.com/site/fullycapable>`_
266 .. [14] `<http://man7.org/linux/man-pages/man8/auditd.8.html>`_