> -----Original Message----- > From: keescook@xxxxxxxxxx [mailto:keescook@xxxxxxxxxx] On Behalf Of Kees > Cook > Sent: Wednesday, October 5, 2016 3:34 PM > To: Roberts, William C <william.c.roberts@xxxxxxxxx> > Cc: kernel-hardening@xxxxxxxxxxxxxxxxxx; Jonathan Corbet <corbet@xxxxxxx>; > linux-doc@xxxxxxxxxxxxxxx; LKML <linux-kernel@xxxxxxxxxxxxxxx>; Nick > Desaulniers <ndesaulniers@xxxxxxxxxx>; Dave Weinstein <olorin@xxxxxxxxxx> > Subject: Re: [PATCH] printk: introduce kptr_restrict level 3 > > On Wed, Oct 5, 2016 at 11:04 AM, <william.c.roberts@xxxxxxxxx> wrote: > > From: William Roberts <william.c.roberts@xxxxxxxxx> > > > > Some out-of-tree modules do not use %pK and just use %p, as it's the > > common C paradigm for printing pointers. Because of this, > > kptr_restrict has no affect on the output and thus, no way to contain > > the kernel address leak. > > Solving this is certainly a good idea -- I'm all for finding a solid solution. > > > Introduce kptr_restrict level 3 that causes the kernel to treat %p as > > if it was %pK and thus always prints zeros. > > I'm worried that this could break kernel internals where %p is being used and not > exposed to userspace. Maybe those situations don't exist... Not saying they don't I didn't find any. > > Regardless, I would rather do what Grsecurity has done in this area, and whitelist > known-safe values instead. For example, they have %pP for approved pointers, > and %pX for approved > dereference_function_descriptor() output. Everything else is censored if it is a > value in kernel memory and destined for a user-space memory > buffer: > > if ((unsigned long)ptr > TASK_SIZE && *fmt != 'P' && *fmt != 'X' && *fmt != > 'K' && is_usercopy_object(buf)) { > printk(KERN_ALERT "grsec: kernel infoleak detected! > Please report this log to spender@xxxxxxxxxxxxxx.\n"); > dump_stack(); > ptr = NULL; > } > > The "is_usercopy_object()" test is something we can add, which is testing for a > new SLAB flag that is used to mark slab caches as either used by user-space or > not, which is done also through whitelisting. > (For more details on this, see: > http://www.openwall.com/lists/kernel-hardening/2016/06/08/10) > > Would you have time/interest to add the slab flags and is_usercopy_object()? > The hardened usercopy part of the slab whitelisting can be separate, since it likely > needs a different usercopy interface to sanely integrate with upstream. I could likely take this on. I would need to read up on the links and have a better concept of what it is. > > -Kees > > -- > Kees Cook > Nexus Security ��.n��������+%������w��{.n�����{����* jg��� �����ݢj����G���� ���j:+v���w�m������w�������h�����٥
