From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752320AbdKHMLA (ORCPT ); Wed, 8 Nov 2017 07:11:00 -0500 Received: from ozlabs.org ([103.22.144.67]:46341 "EHLO ozlabs.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751470AbdKHMK6 (ORCPT ); Wed, 8 Nov 2017 07:10:58 -0500 From: Michael Ellerman To: "Tobin C. Harding" , kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" , "Jason A. Donenfeld" , "Theodore Ts'o" , Linus Torvalds , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts\, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , linux-kernel@vger.kernel.org, Network Development , David Miller Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl In-Reply-To: <1510050731-32446-1-git-send-email-me@tobin.cc> References: <1510050731-32446-1-git-send-email-me@tobin.cc> Date: Wed, 08 Nov 2017 23:10:56 +1100 Message-ID: <87k1z12cof.fsf@concordia.ellerman.id.au> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org "Tobin C. Harding" writes: > Currently we are leaking addresses from the kernel to user space. This > script is an attempt to find some of those leakages. Script parses > `dmesg` output and /proc and /sys files for hex strings that look like > kernel addresses. > > Only works for 64 bit kernels, the reason being that kernel addresses > on 64 bit kernels have 'ffff' as the leading bit pattern making greping > possible. That doesn't work super well on other architectures :D I don't speak perl but presumably you can check the arch somehow and customise the regex? ... > +# Return _all_ non false positive addresses from $line. > +sub extract_addresses > +{ > + my ($line) = @_; > + my $address = '\b(0x)?ffff[[:xdigit:]]{12}\b'; On 64-bit powerpc (ppc64/ppc64le) we'd want: + my $address = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; > +# Do not parse these files (absolute path). > +my @skip_parse_files_abs = ('/proc/kmsg', > + '/proc/kcore', > + '/proc/fs/ext4/sdb1/mb_groups', > + '/proc/1/fd/3', > + '/sys/kernel/debug/tracing/trace_pipe', > + '/sys/kernel/security/apparmor/revision'); Can you add: /sys/firmware/devicetree and/or /proc/device-tree (which is a symlink to the above). We should also start restricting access to that because it may have potentially interesting physical addresses in it, but that will break existing tools, so it will need to be opt-in and done over time. cheers From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Ellerman Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl Date: Wed, 08 Nov 2017 23:10:56 +1100 Message-ID: <87k1z12cof.fsf@concordia.ellerman.id.au> References: <1510050731-32446-1-git-send-email-me@tobin.cc> Mime-Version: 1.0 Content-Type: text/plain Cc: "Tobin C. Harding" , "Jason A. Donenfeld" , Theodore Ts'o , Linus Torvalds , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts\, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , kernel-hardening@lists.openwall.com Return-path: In-Reply-To: <1510050731-32446-1-git-send-email-me@tobin.cc> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org "Tobin C. Harding" writes: > Currently we are leaking addresses from the kernel to user space. This > script is an attempt to find some of those leakages. Script parses > `dmesg` output and /proc and /sys files for hex strings that look like > kernel addresses. > > Only works for 64 bit kernels, the reason being that kernel addresses > on 64 bit kernels have 'ffff' as the leading bit pattern making greping > possible. That doesn't work super well on other architectures :D I don't speak perl but presumably you can check the arch somehow and customise the regex? ... > +# Return _all_ non false positive addresses from $line. > +sub extract_addresses > +{ > + my ($line) = @_; > + my $address = '\b(0x)?ffff[[:xdigit:]]{12}\b'; On 64-bit powerpc (ppc64/ppc64le) we'd want: + my $address = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; > +# Do not parse these files (absolute path). > +my @skip_parse_files_abs = ('/proc/kmsg', > + '/proc/kcore', > + '/proc/fs/ext4/sdb1/mb_groups', > + '/proc/1/fd/3', > + '/sys/kernel/debug/tracing/trace_pipe', > + '/sys/kernel/security/apparmor/revision'); Can you add: /sys/firmware/devicetree and/or /proc/device-tree (which is a symlink to the above). We should also start restricting access to that because it may have potentially interesting physical addresses in it, but that will break existing tools, so it will need to be opt-in and done over time. cheers From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Ellerman In-Reply-To: <1510050731-32446-1-git-send-email-me@tobin.cc> References: <1510050731-32446-1-git-send-email-me@tobin.cc> Date: Wed, 08 Nov 2017 23:10:56 +1100 Message-ID: <87k1z12cof.fsf@concordia.ellerman.id.au> MIME-Version: 1.0 Content-Type: text/plain Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl To: "Tobin C. Harding" , kernel-hardening@lists.openwall.com Cc: "Jason A. Donenfeld" , Theodore Ts'o , Linus Torvalds , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , linux-kernel@vger.kernel.org, Network Development , David Miller List-ID: "Tobin C. Harding" writes: > Currently we are leaking addresses from the kernel to user space. This > script is an attempt to find some of those leakages. Script parses > `dmesg` output and /proc and /sys files for hex strings that look like > kernel addresses. > > Only works for 64 bit kernels, the reason being that kernel addresses > on 64 bit kernels have 'ffff' as the leading bit pattern making greping > possible. That doesn't work super well on other architectures :D I don't speak perl but presumably you can check the arch somehow and customise the regex? ... > +# Return _all_ non false positive addresses from $line. > +sub extract_addresses > +{ > + my ($line) = @_; > + my $address = '\b(0x)?ffff[[:xdigit:]]{12}\b'; On 64-bit powerpc (ppc64/ppc64le) we'd want: + my $address = '\b(0x)?[89abcdef]00[[:xdigit:]]{13}\b'; > +# Do not parse these files (absolute path). > +my @skip_parse_files_abs = ('/proc/kmsg', > + '/proc/kcore', > + '/proc/fs/ext4/sdb1/mb_groups', > + '/proc/1/fd/3', > + '/sys/kernel/debug/tracing/trace_pipe', > + '/sys/kernel/security/apparmor/revision'); Can you add: /sys/firmware/devicetree and/or /proc/device-tree (which is a symlink to the above). We should also start restricting access to that because it may have potentially interesting physical addresses in it, but that will break existing tools, so it will need to be opt-in and done over time. cheers