The patch titled
Subject: [PATCH v4] kptr_restrict for hiding kernel pointers
has been added to the -mm tree. Its filename is
kptr_restrict-for-hiding-kernel-pointers-v4.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this
The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/
------------------------------------------------------
Subject: Subject: [PATCH v4] kptr_restrict for hiding kernel pointers
From: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx>
Add the %pK printk format specifier and
the /proc/sys/kernel/kptr_restrict sysctl.
The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces. Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers. The behavior of %pK depends on the kptr_restrict sysctl.
If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs. If kptr_restrict is set to 1, if the current user (intended to
be a reader via seq_printf(), etc.) does not have CAP_SYSLOG (which is
currently in the LSM tree), kernel pointers using %pK are printed as
0's. If kptr_restrict is set to 2, kernel pointers using %pK are
printed as 0's regardless of privileges. Replacing with 0's was chosen
over the default "(null)", which cannot be parsed by userland %p, which
expects "(nil)".
v4 incorporates Eric Paris' suggestion of using
has_capability_noaudit(), since failing this capability check is not a
policy violation but rather a code path choice and shouldn't generate
potentially excessive log noise. Adjusted IRQ comment for clarity.
Signed-off-by: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx>
Cc: James Morris <jmorris@xxxxxxxxx>
Cc: Eric Dumazet <eric.dumazet@xxxxxxxxx>
Cc: Thomas Graf <tgraf@xxxxxxxxxxxxx>
Cc: Eugene Teo <eugeneteo@xxxxxxxxxx>
Cc: Kees Cook <kees.cook@xxxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxx>
Cc: David S. Miller <davem@xxxxxxxxxxxxx>
Cc: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
Cc: Valdis Kletnieks <Valdis.Kletnieks@xxxxxx>
Cc: Eric Paris <eparis@xxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
Documentation/sysctl/kernel.txt | 16 ++++++++--------
kernel/sysctl.c | 2 +-
lib/vsprintf.c | 12 +++++++-----
security/Kconfig | 12 ------------
4 files changed, 16 insertions(+), 26 deletions(-)
diff -puN Documentation/sysctl/kernel.txt~kptr_restrict-for-hiding-kernel-pointers-v4 Documentation/sysctl/kernel.txt
--- a/Documentation/sysctl/kernel.txt~kptr_restrict-for-hiding-kernel-pointers-v4
+++ a/Documentation/sysctl/kernel.txt
@@ -264,14 +264,14 @@ This flag controls the L2 cache of G3 pr
kptr_restrict:
-This toggle indicates whether unprivileged users are prevented from reading
-kernel addresses via /proc and other interfaces. When kptr_restrict is set
-to (0), there are no restrictions. When kptr_restrict is set to (1), kernel
-pointers printed using the %pK format specifier will be replaced with 0's
-unless the user has CAP_SYSLOG.
-
-The kernel config option CONFIG_SECURITY_KPTR_RESTRICT sets the default
-value of kptr_restrict.
+This toggle indicates whether restrictions are placed on
+exposing kernel addresses via /proc and other interfaces. When
+kptr_restrict is set to (0), the default, there are no
+restrictions. When kptr_restrict is set to (1), kernel pointers
+printed using the %pK format specifier will be replaced with 0's
+unless the user has CAP_SYSLOG. When kptr_restrict is set to
+(2), kernel pointers printed using %pK will be replaced with 0's
+regardless of privileges.
==============================================================
diff -puN kernel/sysctl.c~kptr_restrict-for-hiding-kernel-pointers-v4 kernel/sysctl.c
--- a/kernel/sysctl.c~kptr_restrict-for-hiding-kernel-pointers-v4
+++ a/kernel/sysctl.c
@@ -718,7 +718,7 @@ static struct ctl_table kern_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec_minmax,
.extra1 = &zero,
- .extra2 = &one,
+ .extra2 = &two,
},
{
.procname = "ngroups_max",
diff -puN lib/vsprintf.c~kptr_restrict-for-hiding-kernel-pointers-v4 lib/vsprintf.c
--- a/lib/vsprintf.c~kptr_restrict-for-hiding-kernel-pointers-v4
+++ a/lib/vsprintf.c
@@ -936,7 +936,7 @@ char *uuid_string(char *buf, char *end,
return string(buf, end, uuid, spec);
}
-int kptr_restrict = CONFIG_SECURITY_KPTR_RESTRICT;
+int kptr_restrict;
/*
* Show a '%p' thing. A kernel extension is that the '%p' is followed
@@ -1040,8 +1040,8 @@ char *pointer(const char *fmt, char *buf
*(((struct va_format *)ptr)->va));
case 'K':
/*
- * %pK cannot be used in IRQ context because it tests
- * CAP_SYSLOG.
+ * %pK cannot be used in IRQ context because its test
+ * for CAP_SYSLOG would be meaningless.
*/
if (in_irq() || in_serving_softirq() || in_nmi())
WARN_ONCE(1, "%%pK used in interrupt context.\n");
@@ -1049,8 +1049,10 @@ char *pointer(const char *fmt, char *buf
if (!kptr_restrict)
break; /* %pK does not obscure pointers */
- if (capable(CAP_SYSLOG))
- break; /* privileged apps expose pointers */
+ if ((kptr_restrict != 2) &&
+ has_capability_noaudit(current, CAP_SYSLOG))
+ break; /* privileged apps expose pointers,
+ unless kptr_restrict is 2 */
if (spec.field_width == -1) {
spec.field_width = 2 * sizeof(void *);
diff -puN security/Kconfig~kptr_restrict-for-hiding-kernel-pointers-v4 security/Kconfig
--- a/security/Kconfig~kptr_restrict-for-hiding-kernel-pointers-v4
+++ a/security/Kconfig
@@ -82,18 +82,6 @@ config SECURITY_DMESG_RESTRICT
If you are unsure how to answer this question, answer N.
-config SECURITY_KPTR_RESTRICT
- bool "Hide kernel pointers from unprivileged users"
- default n
- help
- This enforces restrictions on unprivileged users reading kernel
- addresses via various interfaces, e.g. /proc.
-
- If this option is not selected, no restrictions will be enforced
- unless the kptr_restrict sysctl is explicitly set to (1).
-
- If you are unsure how to answer this question, answer N.
-
config SECURITY
bool "Enable different security models"
depends on SYSFS
_
Patches currently in -mm which might be from drosenberg@xxxxxxxxxxxxx are
linux-next.patch
kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users.patch
kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users-fix.patch
kptr_restrict-for-hiding-kernel-pointers-v4.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
