perf tools: Check perf.data owner

Add an owner check to opening perf.data files and a switch to
silence it.

Because perf-report/perf-annotate are binary parsers reading
another users' perf.data file could be a security risk if the
file were explicitly engineered to trigger bugs in the parser
(we hope of course there are non such bugs, but you never
know).

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Paul Mackerras <paulus@samba.org>
LKML-Reference: <20090819092023.896648538@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

2 files changed, 14 insertions, 0 deletions

diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 343e7b14bf0..5e17de984dc 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -31,6 +31,7 @@ static char		*vmlinux = "vmlinux";
 static char             default_sort_order[] = "comm,symbol";
 static char             *sort_order = default_sort_order;
 
+static int              force;
 static int              input;
 static int              show_mask = SHOW_KERNEL | SHOW_USER | SHOW_HV;
 
@@ -1334,6 +1335,11 @@ static int __cmd_annotate(void)
                 exit(-1);
         }
 
+        if (!force && (stat.st_uid != geteuid())) {
+                fprintf(stderr, "file: %s not owned by current user\n", input_name);
+                exit(-1);
+        }
+
         if (!stat.st_size) {
                 fprintf(stderr, "zero-sized file, nothing to do!\n");
                 exit(0);
@@ -1439,6 +1445,7 @@ static const struct option options[] = {
                     "input file name"),
         OPT_STRING('s', "symbol", &sym_hist_filter, "symbol",
                     "symbol to annotate"),
+        OPT_BOOLEAN('f', "force", &force, "don't complain, do it"),
         OPT_BOOLEAN('v', "verbose", &verbose,
                     "be more verbose (show symbol address, etc)"),
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index b53a60fc12d..8b2ec882e6e 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -38,6 +38,7 @@ static char		*dso_list_str, *comm_list_str, *sym_list_str,
 static struct strlist   *dso_list, *comm_list, *sym_list;
 static char             *field_sep;
 
+static int              force;
 static int              input;
 static int              show_mask = SHOW_KERNEL | SHOW_USER | SHOW_HV;
 
@@ -1856,6 +1857,11 @@ static int __cmd_report(void)
                 exit(-1);
         }
 
+        if (!force && (stat.st_uid != geteuid())) {
+                fprintf(stderr, "file: %s not owned by current user\n", input_name);
+                exit(-1);
+        }
+
         if (!stat.st_size) {
                 fprintf(stderr, "zero-sized file, nothing to do!\n");
                 exit(0);
@@ -2064,6 +2070,7 @@ static const struct option options[] = {
         OPT_BOOLEAN('D', "dump-raw-trace", &dump_trace,
                     "dump raw trace in ASCII"),
         OPT_STRING('k', "vmlinux", &vmlinux, "file", "vmlinux pathname"),
+        OPT_BOOLEAN('f', "force", &force, "don't complain, do it"),
         OPT_BOOLEAN('m', "modules", &modules,
                     "load module symbols - WARNING: use only with -k and LIVE kernel"),
         OPT_BOOLEAN('n', "show-nr-samples", &show_nr_samples,