search

grafana / JPProf

Go Pprof but for Java runtime.
Apache License 2.0
69 stars 5 forks source link

Can open perf_event_open instead of sys_admin？ #28

Open DomineCore opened 1 year ago

DomineCore commented 1 year ago

Security department within my company does not allow open containers sys_admin permissions, because it is easy to produce risk. After my guess and actual test, to the open container perf_event_open permission also can achieve the same effect, whether can give other users clue in the document?

github-louis-fruleux commented 1 year ago

Hello @DomineCore, same issue here, they didn't want to open sys_admin (rightly). So we injected a custom seccomp and opened only the perf_even_open syscall which was enough for us (raw EC2 debian + docker)

If you have the latest docker version, there is a profile for this: CAP_PERFMON (but I haven't try it though)

DomineCore commented 1 year ago

@github-louis-fruleux Yeah, now I'm using this profile.