The patch titled kptr_restrict for hiding kernel pointers from unprivileged users has been removed from the -mm tree. Its filename was kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: kptr_restrict for hiding kernel pointers from unprivileged users From: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx> Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict sysctl. The %pK format specifier is designed to hide exposed kernel pointers, specifically via /proc interfaces. Exposing these pointers provides an easy target for kernel write vulnerabilities, since they reveal the locations of writable structures containing easily triggerable function pointers. The behavior of %pK depends on the kptr_restrict sysctl. If kptr_restrict is set to 0, no deviation from the standard %p behavior occurs. If kptr_restrict is set to 1, the default, if the current user (intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG (currently in the LSM tree), kernel pointers using %pK are printed as 0's. If kptr_restrict is set to 2, kernel pointers using %pK are printed as 0's regardless of privileges. Replacing with 0's was chosen over the default "(null)", which cannot be parsed by userland %p, which expects "(nil)". [akpm@xxxxxxxxxxxxxxxxxxxx: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/] [akpm@xxxxxxxxxxxxxxxxxxxx: coding-style fixup] [randy.dunlap@xxxxxxxxxx: fix kernel/sysctl.c warning] Signed-off-by: Dan Rosenberg <drosenberg@xxxxxxxxxxxxx> Signed-off-by: Randy Dunlap <randy.dunlap@xxxxxxxxxx> Cc: James Morris <jmorris@xxxxxxxxx> Cc: Eric Dumazet <eric.dumazet@xxxxxxxxx> Cc: Thomas Graf <tgraf@xxxxxxxxxxxxx> Cc: Eugene Teo <eugeneteo@xxxxxxxxxx> Cc: Kees Cook <kees.cook@xxxxxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxx> Cc: David S. Miller <davem@xxxxxxxxxxxxx> Cc: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx> Cc: Eric Paris <eparis@xxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- Documentation/sysctl/kernel.txt | 14 ++++++++++++++ include/linux/printk.h | 1 + kernel/sysctl.c | 10 ++++++++++ lib/vsprintf.c | 22 ++++++++++++++++++++++ 4 files changed, 47 insertions(+) diff -puN Documentation/sysctl/kernel.txt~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users Documentation/sysctl/kernel.txt --- a/Documentation/sysctl/kernel.txt~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users +++ a/Documentation/sysctl/kernel.txt @@ -34,6 +34,7 @@ show up in /proc/sys/kernel: - hotplug - java-appletviewer [ binfmt_java, obsolete ] - java-interpreter [ binfmt_java, obsolete ] +- kptr_restrict - kstack_depth_to_print [ X86 only ] - l2cr [ PPC only ] - modprobe ==> Documentation/debugging-modules.txt @@ -261,6 +262,19 @@ This flag controls the L2 cache of G3 pr ============================================================== +kptr_restrict: + +This toggle indicates whether restrictions are placed on +exposing kernel addresses via /proc and other interfaces. When +kptr_restrict is set to (0), there are no restrictions. When +kptr_restrict is set to (1), the default, kernel pointers +printed using the %pK format specifier will be replaced with 0's +unless the user has CAP_SYSLOG. When kptr_restrict is set to +(2), kernel pointers printed using %pK will be replaced with 0's +regardless of privileges. + +============================================================== + kstack_depth_to_print: (X86 only) Controls the number of words to print when dumping the raw diff -puN include/linux/printk.h~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users include/linux/printk.h --- a/include/linux/printk.h~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users +++ a/include/linux/printk.h @@ -83,6 +83,7 @@ extern bool printk_timed_ratelimit(unsig extern int printk_delay_msec; extern int dmesg_restrict; +extern int kptr_restrict; /* * Print a one-time message (analogous to WARN_ONCE() et al): diff -puN kernel/sysctl.c~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users kernel/sysctl.c --- a/kernel/sysctl.c~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users +++ a/kernel/sysctl.c @@ -24,6 +24,7 @@ #include <linux/slab.h> #include <linux/sysctl.h> #include <linux/signal.h> +#include <linux/printk.h> #include <linux/proc_fs.h> #include <linux/security.h> #include <linux/ctype.h> @@ -710,6 +711,15 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &one, }, + { + .procname = "kptr_restrict", + .data = &kptr_restrict, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &two, + }, #endif { .procname = "ngroups_max", diff -puN lib/vsprintf.c~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users lib/vsprintf.c --- a/lib/vsprintf.c~kptr_restrict-for-hiding-kernel-pointers-from-unprivileged-users +++ a/lib/vsprintf.c @@ -936,6 +936,8 @@ char *uuid_string(char *buf, char *end, return string(buf, end, uuid, spec); } +int kptr_restrict = 1; + /* * Show a '%p' thing. A kernel extension is that the '%p' is followed * by an extra set of alphanumeric characters that are extended format @@ -979,6 +981,7 @@ char *uuid_string(char *buf, char *end, * Implements a "recursive vsnprintf". * Do not use this feature without some mechanism to verify the * correctness of the format string and va_list arguments. + * - 'K' For a kernel pointer that should be hidden from unprivileged users * * Note: The difference between 'S' and 'F' is that on ia64 and ppc64 * function pointers are really function descriptors, which contain a @@ -1035,6 +1038,25 @@ char *pointer(const char *fmt, char *buf return buf + vsnprintf(buf, end - buf, ((struct va_format *)ptr)->fmt, *(((struct va_format *)ptr)->va)); + case 'K': + /* + * %pK cannot be used in IRQ context because its test + * for CAP_SYSLOG would be meaningless. + */ + if (in_irq() || in_serving_softirq() || in_nmi()) { + if (spec.field_width == -1) + spec.field_width = 2 * sizeof(void *); + return string(buf, end, "pK-error", spec); + } else if ((kptr_restrict == 0) || + (kptr_restrict == 1 && + has_capability_noaudit(current, CAP_SYSLOG))) + break; + + if (spec.field_width == -1) { + spec.field_width = 2 * sizeof(void *); + spec.flags |= ZEROPAD; + } + return number(buf, end, 0, spec); } spec.flags |= SMALL; if (spec.field_width == -1) { _ Patches currently in -mm which might be from drosenberg@xxxxxxxxxxxxx are origin.patch net-convert-%p-usage-to-%pk.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html