perf: Refactor permissions check into perf_check_permission()

Refactor the permission check in perf_event_open() into a helper
perf_check_permission(). This makes the permission check logic more
readable (because we no longer have a negated disjunction). Add a
comment mentioning the ptrace check also checks the uid.

No functional change intended.

Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://lore.kernel.org/r/20210705084453.2151729-2-elver@google.com

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c13730b..1cb1f9b 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -11917,6 +11917,37 @@ again:
        return gctx;
 }
 
+static bool
+perf_check_permission(struct perf_event_attr *attr, struct task_struct *task)
+{
+       unsigned int ptrace_mode = PTRACE_MODE_READ_REALCREDS;
+       bool is_capable = perfmon_capable();
+
+       if (attr->sigtrap) {
+               /*
+                * perf_event_attr::sigtrap sends signals to the other task.
+                * Require the current task to also have CAP_KILL.
+                */
+               rcu_read_lock();
+               is_capable &= ns_capable(__task_cred(task)->user_ns, CAP_KILL);
+               rcu_read_unlock();
+
+               /*
+                * If the required capabilities aren't available, checks for
+                * ptrace permissions: upgrade to ATTACH, since sending signals
+                * can effectively change the target task.
+                */
+               ptrace_mode = PTRACE_MODE_ATTACH_REALCREDS;
+       }
+
+       /*
+        * Preserve ptrace permission check for backwards compatibility. The
+        * ptrace check also includes checks that the current task and other
+        * task have matching uids, and is therefore not done here explicitly.
+        */
+       return is_capable || ptrace_may_access(task, ptrace_mode);
+}
+
 /**
  * sys_perf_event_open - open a performance event, associate it to a task/cpu
  *
@@ -12158,43 +12189,18 @@ SYSCALL_DEFINE5(perf_event_open,
        }
 
        if (task) {
-               unsigned int ptrace_mode = PTRACE_MODE_READ_REALCREDS;
-               bool is_capable;
-
                err = down_read_interruptible(&task->signal->exec_update_lock);
                if (err)
                        goto err_file;
 
-               is_capable = perfmon_capable();
-               if (attr.sigtrap) {
-                       /*
-                        * perf_event_attr::sigtrap sends signals to the other
-                        * task. Require the current task to also have
-                        * CAP_KILL.
-                        */
-                       rcu_read_lock();
-                       is_capable &= ns_capable(__task_cred(task)->user_ns, CAP_KILL);
-                       rcu_read_unlock();
-
-                       /*
-                        * If the required capabilities aren't available, checks
-                        * for ptrace permissions: upgrade to ATTACH, since
-                        * sending signals can effectively change the target
-                        * task.
-                        */
-                       ptrace_mode = PTRACE_MODE_ATTACH_REALCREDS;
-               }
-
                /*
-                * Preserve ptrace permission check for backwards compatibility.
-                *
                 * We must hold exec_update_lock across this and any potential
                 * perf_install_in_context() call for this new event to
                 * serialize against exec() altering our credentials (and the
                 * perf_event_exit_task() that could imply).
                 */
                err = -EACCES;
-               if (!is_capable && !ptrace_may_access(task, ptrace_mode))
+               if (!perf_check_permission(&attr, task))
                        goto err_cred;
        }