[PATCH] tracing: Restrict perf filters that read kernel strings

[PATCH] tracing: Restrict perf filters that read kernel strings

[Kyle Zeng]

A task-bound, counting-only syscall tracepoint can be opened without
permission to read raw kernel tracepoint data. Setting exclude_kernel
does not prevent its filter from running: perf_syscall_enter() submits
the saved user-mode registers.

Pointer-string filters use FILTER_PRED_FN_PCHAR by default, which reads
through strncpy_from_kernel_nofault(). For sys_enter_openat, for example,
the filename field comes directly from a syscall argument. An
unprivileged caller can pass a kernel address, install a filter such as
'filename ~ "Linux version*"', and use the event count to test the
contents of kernel memory, even with perf_event_paranoid=2.

Check the compiled filter before installing it and require the same
kernel and raw-tracepoint permissions as access to raw kernel tracepoint
data for FILTER_PRED_FN_PCHAR. Inspect every predicate so that other
events, operators, and boolean expressions cannot bypass the check.
Return the permission error through the existing cleanup path before
publishing the filter.

Keep user-pointer (.ustring) and record-local predicates available under
the existing policy. This leaves tracefs filtering and authorized kernel
string filtering unchanged.

Fixes: 5967bd5c4239 ("tracing: Let filter_assign_type() detect FILTER_PTR_STRING")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 kernel/trace/trace_events_filter.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 2b46ca536045..76aca560491b 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -2704,6 +2704,28 @@ static int ftrace_function_set_filter(struct perf_event *event,
 }
 #endif /* CONFIG_FUNCTION_TRACER */
 
+static int ftrace_profile_filter_perm(struct event_filter *filter)
+{
+	struct prog_entry *prog = rcu_dereference_protected(filter->prog,
+						lockdep_is_held(&event_mutex));
+	int i, err;
+
+	for (i = 0; prog[i].pred; i++) {
+		if (prog[i].pred->fn_num != FILTER_PRED_FN_PCHAR)
+			continue;
+
+		/*
+		 * Even a counting filter can reveal kernel string data.
+		 * Require the same access as raw kernel tracepoints.
+		 */
+		err = perf_allow_kernel();
+		if (err)
+			return err;
+		return perf_allow_tracepoint();
+	}
+	return 0;
+}
+
 int ftrace_profile_set_filter(struct perf_event *event, int event_id,
 			      char *filter_str)
 {
@@ -2725,6 +2747,10 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
 	if (err)
 		goto free_filter;
 
+	err = ftrace_profile_filter_perm(filter);
+	if (err)
+		goto free_filter;
+
 	if (ftrace_event_is_function(call))
 		err = ftrace_function_set_filter(event, filter);
 	else

base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab
-- 
2.53.0

Re: [PATCH] tracing: Restrict perf filters that read kernel strings

[Masami Hiramatsu]

On Tue, 06 Oct 2026 15:40:05 -0700, Kyle Zeng <kylebot@openai.com> wrote:
> A task-bound, counting-only syscall tracepoint can be opened without
> permission to read raw kernel tracepoint data. Setting exclude_kernel
> does not prevent its filter from running: perf_syscall_enter() submits
> the saved user-mode registers.
>
> Pointer-string filters use FILTER_PRED_FN_PCHAR by default, which reads
> through strncpy_from_kernel_nofault(). For sys_enter_openat, for example,
> the filename field comes directly from a syscall argument. An
> unprivileged caller can pass a kernel address, install a filter such as
> 'filename ~ "Linux version*"', and use the event count to test the
> contents of kernel memory, even with perf_event_paranoid=2.
>
> Check the compiled filter before installing it and require the same
> kernel and raw-tracepoint permissions as access to raw kernel tracepoint
> data for FILTER_PRED_FN_PCHAR. Inspect every predicate so that other
> events, operators, and boolean expressions cannot bypass the check.
> Return the permission error through the existing cleanup path before
> publishing the filter.
>
> Keep user-pointer (.ustring) and record-local predicates available under
> the existing policy. This leaves tracefs filtering and authorized kernel
> string filtering unchanged.
>
> Fixes: 5967bd5c4239 ("tracing: Let filter_assign_type() detect FILTER_PTR_STRING")
> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Looks good to me.

Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Thanks,


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>