From: Frank Rowand <frowand.list@gmail.com> To: Michael Ellerman <mpe@ellerman.id.au>, "Tobin C. Harding" <me@tobin.cc>, kernel-hardening@lists.openwall.com Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>, "Theodore Ts'o" <tytso@mit.edu>, Linus Torvalds <torvalds@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Paolo Bonzini <pbonzini@redhat.com>, Tycho Andersen <tycho@docker.com>, "Roberts, William C" <william.c.roberts@intel.com>, Tejun Heo <tj@kernel.org>, Jordan Glover <Golden_Miller83@protonmail.ch>, Greg KH <gregkh@linuxfoundation.org>, Petr Mladek <pmladek@suse.com>, Joe Perches <joe@perches.com>, Ian Campbell <ijc@hellion.org.uk>, Sergey Senozhatsky <sergey.senozhatsky@gmail.com>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <wilal.deacon@arm.com>, Steven Rostedt <rostedt@goodmis.org>, Chris Fries <cfries@google.com>, Dave Weinstein <olorin@google.com>, Daniel Micay <danielmicay@gmail.com>, Djalal Harouni <tixxdz@gmail.com>, linux-kernel@vger.kernel.org, Network Development <netdev@vger.kernel.org>, David Miller <davem@davemloft.net> Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl Date: Fri, 10 Nov 2017 14:12:46 -0800 [thread overview] Message-ID: <7fa01b32-4db0-3742-067b-955969020953@gmail.com> (raw) In-Reply-To: <87k1z12cof.fsf@concordia.ellerman.id.au> Hi Michael, Tobin, On 11/08/17 04:10, Michael Ellerman wrote: > "Tobin C. Harding" <me@tobin.cc> writes: >> Currently we are leaking addresses from the kernel to user space. This >> script is an attempt to find some of those leakages. Script parses >> `dmesg` output and /proc and /sys files for hex strings that look like >> kernel addresses. >> >> Only works for 64 bit kernels, the reason being that kernel addresses >> on 64 bit kernels have 'ffff' as the leading bit pattern making greping >> possible. > > That doesn't work super well on other architectures :D > > I don't speak perl but presumably you can check the arch somehow and > customise the regex? > > ... >> +# Return _all_ non false positive addresses from $line. >> +sub extract_addresses >> +{ >> + my ($line) = @_; >> + my $address = '\b(0x)?ffff[[:xdigit:]]{12}\b'; > > On 64-bit powerpc (ppc64/ppc64le) we'd want: > > + my $address = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; > > >> +# Do not parse these files (absolute path). >> +my @skip_parse_files_abs = ('/proc/kmsg', >> + '/proc/kcore', >> + '/proc/fs/ext4/sdb1/mb_groups', >> + '/proc/1/fd/3', >> + '/sys/kernel/debug/tracing/trace_pipe', >> + '/sys/kernel/security/apparmor/revision'); > > Can you add: > > /sys/firmware/devicetree > > and/or /proc/device-tree (which is a symlink to the above). /proc/device-tree is a symlink to /sys/firmware/devicetree/base /sys/firmware contains fdt -- the flattened device tree that was passed to the kernel on boot devicetree/base/ -- the data that is currently in the live device tree. This live device tree is represented as directories and files beneath base/ The information in fdt is directly available in the kernel source tree (possible exception: the bootloader may have modified the fdt, possibly to add/modify the boot command line, add memory size). The information in devicetree/base/ is directly available in the kernel source tree for _most_ architectures, with the same possible exception for the bootloader. ppc64 may also modify this information dynamically after the system is booted. When overlay support is working, overlay device trees will also be able to modify this information dynamically (and again, this information will be directly available in the kernel source tree). Not having read the code in leaking_addresses.pl, trusting that the comments are correct, it seems that /sys/firmware should be in @skip_walk_dirs_abs instead of putting /sys/firmware/devicetree in @skip_parse_files_abs. > We should also start restricting access to that because it may have > potentially interesting physical addresses in it, but that will break > existing tools, so it will need to be opt-in and done over time. > > cheers >
WARNING: multiple messages have this Message-ID (diff)
From: Frank Rowand <frowand.list@gmail.com> To: Michael Ellerman <mpe@ellerman.id.au>, "Tobin C. Harding" <me@tobin.cc>, kernel-hardening@lists.openwall.com Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>, Theodore Ts'o <tytso@mit.edu>, Linus Torvalds <torvalds@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Paolo Bonzini <pbonzini@redhat.com>, Tycho Andersen <tycho@docker.com>, "Roberts, William C" <william.c.roberts@intel.com>, Tejun Heo <tj@kernel.org>, Jordan Glover <Golden_Miller83@protonmail.ch>, Greg KH <gregkh@linuxfoundation.org>, Petr Mladek <pmladek@suse.com>, Joe Perches <joe@perches.com>, Ian Campbell <ijc@hellion.org.uk>, Sergey Senozhatsky <sergey.senozhatsky@gmail.com>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <wilal.deacon@arm.com>, Steven Rostedt <rostedt@goodmis.org>, Chris Fries <cfries@google.com>, Dave Weinstein <olorin@google.com>, Daniel Micay <danielmicay@g Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl Date: Fri, 10 Nov 2017 14:12:46 -0800 [thread overview] Message-ID: <7fa01b32-4db0-3742-067b-955969020953@gmail.com> (raw) In-Reply-To: <87k1z12cof.fsf@concordia.ellerman.id.au> Hi Michael, Tobin, On 11/08/17 04:10, Michael Ellerman wrote: > "Tobin C. Harding" <me@tobin.cc> writes: >> Currently we are leaking addresses from the kernel to user space. This >> script is an attempt to find some of those leakages. Script parses >> `dmesg` output and /proc and /sys files for hex strings that look like >> kernel addresses. >> >> Only works for 64 bit kernels, the reason being that kernel addresses >> on 64 bit kernels have 'ffff' as the leading bit pattern making greping >> possible. > > That doesn't work super well on other architectures :D > > I don't speak perl but presumably you can check the arch somehow and > customise the regex? > > ... >> +# Return _all_ non false positive addresses from $line. >> +sub extract_addresses >> +{ >> + my ($line) = @_; >> + my $address = '\b(0x)?ffff[[:xdigit:]]{12}\b'; > > On 64-bit powerpc (ppc64/ppc64le) we'd want: > > + my $address = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; > > >> +# Do not parse these files (absolute path). >> +my @skip_parse_files_abs = ('/proc/kmsg', >> + '/proc/kcore', >> + '/proc/fs/ext4/sdb1/mb_groups', >> + '/proc/1/fd/3', >> + '/sys/kernel/debug/tracing/trace_pipe', >> + '/sys/kernel/security/apparmor/revision'); > > Can you add: > > /sys/firmware/devicetree > > and/or /proc/device-tree (which is a symlink to the above). /proc/device-tree is a symlink to /sys/firmware/devicetree/base /sys/firmware contains fdt -- the flattened device tree that was passed to the kernel on boot devicetree/base/ -- the data that is currently in the live device tree. This live device tree is represented as directories and files beneath base/ The information in fdt is directly available in the kernel source tree (possible exception: the bootloader may have modified the fdt, possibly to add/modify the boot command line, add memory size). The information in devicetree/base/ is directly available in the kernel source tree for _most_ architectures, with the same possible exception for the bootloader. ppc64 may also modify this information dynamically after the system is booted. When overlay support is working, overlay device trees will also be able to modify this information dynamically (and again, this information will be directly available in the kernel source tree). Not having read the code in leaking_addresses.pl, trusting that the comments are correct, it seems that /sys/firmware should be in @skip_walk_dirs_abs instead of putting /sys/firmware/devicetree in @skip_parse_files_abs. > We should also start restricting access to that because it may have > potentially interesting physical addresses in it, but that will break > existing tools, so it will need to be opt-in and done over time. > > cheers >
next prev parent reply other threads:[~2017-11-10 22:12 UTC|newest] Thread overview: 98+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-07 10:32 [PATCH v4] scripts: add leaking_addresses.pl Tobin C. Harding 2017-11-07 10:32 ` [kernel-hardening] " Tobin C. Harding 2017-11-07 10:32 ` Tobin C. Harding 2017-11-07 10:50 ` Greg KH 2017-11-07 10:50 ` [kernel-hardening] " Greg KH 2017-11-07 10:50 ` Greg KH 2017-11-07 20:51 ` Tobin C. Harding 2017-11-07 20:51 ` [kernel-hardening] " Tobin C. Harding 2017-11-07 20:51 ` Tobin C. Harding 2017-11-07 13:56 ` David Laight 2017-11-07 13:56 ` [kernel-hardening] " David Laight 2017-11-07 13:56 ` David Laight 2017-11-07 20:58 ` Tobin C. Harding 2017-11-07 20:58 ` [kernel-hardening] " Tobin C. Harding 2017-11-07 20:58 ` Tobin C. Harding 2017-11-07 21:11 ` Linus Torvalds 2017-11-07 21:11 ` [kernel-hardening] " Linus Torvalds 2017-11-07 21:11 ` Linus Torvalds 2017-11-07 15:51 ` Petr Mladek 2017-11-07 15:51 ` [kernel-hardening] " Petr Mladek 2017-11-07 15:51 ` Petr Mladek 2017-11-07 20:39 ` Tobin C. Harding 2017-11-07 20:39 ` [kernel-hardening] " Tobin C. Harding 2017-11-07 20:39 ` Tobin C. Harding 2017-11-07 23:36 ` [kernel-hardening] " Laura Abbott 2017-11-07 23:36 ` Laura Abbott 2017-11-08 0:59 ` Linus Torvalds 2017-11-08 0:59 ` Linus Torvalds 2017-11-08 0:59 ` Linus Torvalds 2017-11-08 20:39 ` Linus Torvalds 2017-11-08 20:39 ` Linus Torvalds 2017-11-08 20:39 ` Linus Torvalds 2017-11-09 4:43 ` Kaiwan N Billimoria 2017-11-09 4:43 ` Kaiwan N Billimoria 2017-11-09 4:43 ` Kaiwan N Billimoria 2017-11-09 4:54 ` Kaiwan N Billimoria 2017-11-09 4:54 ` Kaiwan N Billimoria 2017-11-09 4:54 ` Kaiwan N Billimoria 2017-11-09 18:11 ` Steven Rostedt 2017-11-09 18:11 ` Steven Rostedt 2017-11-09 18:11 ` Steven Rostedt 2017-11-10 3:03 ` Kaiwan N Billimoria 2017-11-10 3:03 ` Kaiwan N Billimoria 2017-11-10 3:03 ` Kaiwan N Billimoria 2017-11-08 1:13 ` Tobin C. Harding 2017-11-08 1:13 ` Tobin C. Harding 2017-11-08 12:10 ` [kernel-hardening] " Michael Ellerman 2017-11-08 12:10 ` Michael Ellerman 2017-11-08 12:10 ` Michael Ellerman 2017-11-08 21:16 ` Tobin C. Harding 2017-11-08 21:16 ` Tobin C. Harding 2017-11-08 22:48 ` Tobin C. Harding 2017-11-08 22:48 ` Tobin C. Harding 2017-11-09 0:49 ` Michael Ellerman 2017-11-09 0:49 ` Michael Ellerman 2017-11-09 0:49 ` Michael Ellerman 2017-11-09 2:08 ` Tobin C. Harding 2017-11-09 2:08 ` Tobin C. Harding 2017-11-10 22:12 ` Frank Rowand [this message] 2017-11-10 22:12 ` [kernel-hardening] " Frank Rowand 2017-11-12 11:49 ` Michael Ellerman 2017-11-12 11:49 ` Michael Ellerman 2017-11-12 11:49 ` Michael Ellerman 2017-11-12 18:02 ` Frank Rowand 2017-11-12 18:02 ` Frank Rowand 2017-11-12 21:18 ` Tobin C. Harding 2017-11-12 21:18 ` Tobin C. Harding 2017-11-13 1:06 ` Michael Ellerman 2017-11-13 1:06 ` Michael Ellerman 2017-11-13 1:06 ` Michael Ellerman 2017-11-10 13:56 ` kaiwan.billimoria 2017-11-10 13:56 ` kaiwan.billimoria 2017-11-12 22:21 ` Tobin C. Harding 2017-11-12 22:21 ` Tobin C. Harding 2017-11-13 5:46 ` kaiwan.billimoria 2017-11-13 5:46 ` kaiwan.billimoria 2017-11-13 6:08 ` Tobin C. Harding 2017-11-13 6:08 ` Tobin C. Harding 2017-11-13 6:52 ` Kaiwan N Billimoria 2017-11-13 6:52 ` Kaiwan N Billimoria 2017-11-20 15:39 ` [kernel-hardening] " Petr Mladek 2017-11-20 15:39 ` Petr Mladek 2017-11-19 23:56 ` [kernel-hardening] " Tobin C. Harding 2017-11-19 23:56 ` Tobin C. Harding 2017-11-11 23:10 ` Kirill A. Shutemov 2017-11-11 23:10 ` [kernel-hardening] " Kirill A. Shutemov 2017-11-11 23:10 ` Kirill A. Shutemov 2017-11-12 23:06 ` Tobin C. Harding 2017-11-12 23:06 ` [kernel-hardening] " Tobin C. Harding 2017-11-12 23:06 ` Tobin C. Harding 2017-11-13 3:37 ` Kirill A. Shutemov 2017-11-13 3:37 ` [kernel-hardening] " Kirill A. Shutemov 2017-11-13 3:37 ` Kirill A. Shutemov 2017-11-13 4:35 ` Tobin C. Harding 2017-11-13 4:35 ` [kernel-hardening] " Tobin C. Harding 2017-11-13 4:35 ` Tobin C. Harding 2017-11-13 5:27 ` [kernel-hardening] " Kaiwan N Billimoria 2017-11-13 5:27 ` Kaiwan N Billimoria
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=7fa01b32-4db0-3742-067b-955969020953@gmail.com \ --to=frowand.list@gmail.com \ --cc=Golden_Miller83@protonmail.ch \ --cc=Jason@zx2c4.com \ --cc=catalin.marinas@arm.com \ --cc=cfries@google.com \ --cc=danielmicay@gmail.com \ --cc=davem@davemloft.net \ --cc=gregkh@linuxfoundation.org \ --cc=ijc@hellion.org.uk \ --cc=joe@perches.com \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=me@tobin.cc \ --cc=mpe@ellerman.id.au \ --cc=netdev@vger.kernel.org \ --cc=olorin@google.com \ --cc=pbonzini@redhat.com \ --cc=pmladek@suse.com \ --cc=rostedt@goodmis.org \ --cc=sergey.senozhatsky@gmail.com \ --cc=tixxdz@gmail.com \ --cc=tj@kernel.org \ --cc=torvalds@linux-foundation.org \ --cc=tycho@docker.com \ --cc=tytso@mit.edu \ --cc=wilal.deacon@arm.com \ --cc=william.c.roberts@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.