Minimal supplement to upstream Kernel Self Protection Project changes. Features already provided by SELinux + Yama and archs other than multiarch arm64 / x86_64 aren't in scope. Only tags have stable history. Shared IRC channel with KSPP: irc.libera.chat #linux-hardening
74d5f3d06f
Add utilities to help checking capabilities of the running procss. Make
perf link with libcap, if it is available. If no libcap-dev[el], assume
no capabilities.
Committer testing:
$ make O=/tmp/build/perf -C tools/perf install-bin
make: Entering directory '/home/acme/git/perf/tools/perf'
BUILD: Doing 'make -j8' parallel build
Auto-detecting system features:
<SNIP>
... libbfd: [ on ]
... libcap: [ OFF ]
... libelf: [ on ]
<SNIP>
Makefile.config:833: No libcap found, disables capability support, please install libcap-devel/libcap-dev
<SNIP>
$ grep libcap /tmp/build/perf/FEATURE-DUMP
feature-libcap=0
$ cat /tmp/build/perf/feature/test-libcap.make.output
test-libcap.c:2:10: fatal error: sys/capability.h: No such file or directory
2 | #include <sys/capability.h>
| ^~~~~~~~~~~~~~~~~~
compilation terminated.
$
Now install libcap-devel and try again:
$ make O=/tmp/build/perf -C tools/perf install-bin
make: Entering directory '/home/acme/git/perf/tools/perf'
BUILD: Doing 'make -j8' parallel build
Warning: Kernel ABI header at 'tools/include/linux/bits.h' differs from latest version at 'include/linux/bits.h'
diff -u tools/include/linux/bits.h include/linux/bits.h
Warning: Kernel ABI header at 'tools/arch/x86/include/asm/cpufeatures.h' differs from latest version at 'arch/x86/include/asm/cpufeatures.h'
diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h
Auto-detecting system features:
<SNIP>
... libbfd: [ on ]
... libcap: [ on ]
... libelf: [ on ]
<SNIP>>
CC /tmp/build/perf/jvmti/libjvmti.o
<SNIP>>
$ grep libcap /tmp/build/perf/FEATURE-DUMP
feature-libcap=1
$ cat /tmp/build/perf/feature/test-libcap.make.output
$ ldd /tmp/build/perf/feature/test-libcap.make.bin
ldd: /tmp/build/perf/feature/test-libcap.make.bin: No such file or directory
$ ldd /tmp/build/perf/feature/test-libcap.bin
linux-vdso.so.1 (0x00007ffc35bfe000)
libcap.so.2 => /lib64/libcap.so.2 (0x00007ff9c62ff000)
libc.so.6 => /lib64/libc.so.6 (0x00007ff9c6139000)
/lib64/ld-linux-x86-64.so.2 (0x00007ff9c6326000)
$
Signed-off-by: Igor Lubashev <ilubashe@akamai.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: James Morris <jmorris@namei.org>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Suzuki Poulouse <suzuki.poulose@arm.com>
[ split from a larger patch ]
Link: http://lkml.kernel.org/r/8a1e76cf5c7c9796d0d4d240fbaa85305298aafa.1565188228.git.ilubashe@akamai.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
|
||
|---|---|---|
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| Documentation | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| LICENSES | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | ||
| .cocciconfig | ||
| .get_maintainer.ignore | ||
| .gitattributes | ||
| .gitignore | ||
| .mailmap | ||
| COPYING | ||
| CREDITS | ||
| Kbuild | ||
| Kconfig | ||
| MAINTAINERS | ||
| Makefile | ||
| README | ||
Linux kernel
============
There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.
In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``. The formatted documentation can also be read online at:
https://www.kernel.org/doc/html/latest/
There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.