extras disabled by softmode in 2.0 about tpe-lkm HOT 10 CLOSED

Did you load the tpe module after install? The rpm set it to load at boot, but doesn't look like it loads at install time. Run this:
sudo modprobe tpe
The modprobe command should read in the config - if not, run this and then retry testing your features:
sudo sysctl -p /etc/sysctl.d/tpe.conf
If still not working, run the test suite (from the git repository) and let me know the output:
make clean test
The test assumes you have sudo permissions. It also unloads the module after it finishes.

from tpe-lkm.

Also I just noticed you have:
tpe.softmode = 1
The softmode makes all features permissable. Check your dmesg or look in /var/log/messages to see the denial of access to /proc/kallsyms. It won't log on the ps denials.

from tpe-lkm.

After further poking it appears as though the behavior of tpe.softmode has changed. In 1.1.0 when softmode = 1 the 'extras' features still operate as intended. However, in 2.x when softmode = 1, they do not.

I verified this on multiple el6 systems I have running 1.0.3 and 1.1.0 where softmode = 1 w/ extras also enabled and all work as intended (e.g: create test user, cant cat kallsysm, list kmods or list unowned processes).

When testing the same against 2.x, softmode = 1 is causing all 'extras' to not operate. Is this an intentional change?

from tpe-lkm.

Yes that was an intended change. Softmode was meant to not deny anything at all - so the extras working in softmode was a bug that was fixed in 2.0. Do you run this module just for the extras, and not tpe itself?

from tpe-lkm.

On shared systems I run it for just the extras, on more tightly controlled internal systems and/or PCI compliant ones, I more broadly leverage all TPE features.

It is a nice to have in high user count shared systems where the extra's make allot of sense.

from tpe-lkm.

How practical would it be to separate softmode into two sysctl knobs?

Such as:
tpe.softmode
tpe.extras.softmode

Or, an alternative approach:
tpe.extras.softmode.ignore

Thoughts?

from tpe-lkm.

I can do a tpe.extras.ignore_softmode. I just pushed a commit to branch feature/ignore_softmode that is, for now, a hard-coded ignore softmode. I'll merge it back to master after it's properly tiedied up.

from tpe-lkm.

Awesome, thank you. That will be super helpful to have as a mainline feature!

from tpe-lkm.

Feature added in db55610

from tpe-lkm.

Also added tpe.extras.log in 8ced813 so you can still log denied extras when normal tpe.log is off.

from tpe-lkm.