On Tue, Aug 27, 2019 at 04:01:08PM -0700, Andy Lutomirski wrote:

quoted

Tracing:

CAP_BPF and perf_paranoid_tracepoint_raw() (which is kernel.perf_event_paranoid == -1)
are necessary to:

That's not tracing, that's perf.

quoted

+bool cap_bpf_tracing(void)
+{
+       return capable(CAP_SYS_ADMIN) ||
+              (capable(CAP_BPF) && !perf_paranoid_tracepoint_raw());
+}

A whole long time ago, I proposed we introduce CAP_PERF or something
along those lines; as a replacement for that horrible crap Android and
Debian ship. But nobody was ever interested enough.

The nice thing about that is that you can then disallow perf/tracing in
general, but tag the perf executable (and similar tools) with the
capability so that unpriv users can still use it, but only limited
through the tool, not the syscalls directly.