[SRU][J:linux-aws/N:linux-aws/R:linux-aws/S:linux-aws][PATCH 1/1] UBUNTU: SAUCE: perf/core: Allow CAP_PERFMON for paranoid level 4

[Máté Szabó]

From: Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com>

BugLink: https://bugs.launchpad.net/bugs/2131046

The Ubuntu-specific perf_event_paranoid level 4 introduces an additional
capability check that requires CAP_SYS_ADMIN to access perf events.
However, this check was implemented before CAP_PERFMON was introduced,
and was never updated to recognize the new capability.

CAP_PERFMON was specifically designed to allow performance monitoring
operations without granting the broad privileges of CAP_SYS_ADMIN. The
current implementation forces users to grant CAP_SYS_ADMIN even when
CAP_PERFMON would be sufficient, violating the principle of least
privilege.

The perfmon_capable() helper function checks for either CAP_PERFMON or
CAP_SYS_ADMIN, providing the intended functionality while maintaining
backward compatibility with systems that use CAP_SYS_ADMIN.

This change allows processes with CAP_PERFMON to access perf events when
perf_event_paranoid is set to 4, while still requiring explicit grants
as intended by the stricter paranoid level. Processes with CAP_SYS_ADMIN
continue to work as before.

Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer at canonical.com>
Signed-off-by: Paolo Pisati <p.pisati at gmail.com>
(cherry picked from commit 65c6a15cd81bdd22523530e5a688159af21dae8c)
Signed-off-by: Máté Szabó <mszabo at salesforce.com>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 73d124e6db82..7f2d5e335865 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12822,7 +12822,7 @@ SYSCALL_DEFINE5(perf_event_open,
 	if (flags & ~PERF_FLAG_ALL)
 		return -EINVAL;
 
-	if (perf_paranoid_any() && !capable(CAP_SYS_ADMIN))
+	if (perf_paranoid_any() && !perfmon_capable())
 		return -EACCES;
 
 	err = perf_copy_attr(attr_uptr, &attr);
-- 
2.55.0