From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752303AbdKIEy4 (ORCPT ); Wed, 8 Nov 2017 23:54:56 -0500 Received: from mail-ot0-f195.google.com ([74.125.82.195]:52361 "EHLO mail-ot0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751786AbdKIEyx (ORCPT ); Wed, 8 Nov 2017 23:54:53 -0500 X-Google-Smtp-Source: AGs4zMZTvaofmIDALevBwBPSAIczD/PBqOZLXtQRZeEYMtdbdnlLa5S3+uHmmSOIGRabl2LeP6oEwjKcRCPij1HcsZM= MIME-Version: 1.0 In-Reply-To: References: <1510050731-32446-1-git-send-email-me@tobin.cc> From: Kaiwan N Billimoria Date: Thu, 9 Nov 2017 10:24:32 +0530 Message-ID: Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl To: Linus Torvalds Cc: Laura Abbott , "Tobin C. Harding" , "kernel-hardening@lists.openwall.com" , "Jason A. Donenfeld" , "Theodore Ts'o" , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , Linux Kernel Mailing List , Network Development , David Miller Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Nov 9, 2017 at 10:13 AM, Kaiwan N Billimoria wrote: >> But I don't know if there is anything else than the profiling code >> that _really_ wants access to /proc/kallsyms in user space as a >> regular user. > Front-ends to ftrace, like trace-cmd? [from the trace-cmd git repo (Steve Rostedt, pl stand up, pl stand up :-) Documentation/trace-cmd-restore.1.txt : ... *-k* kallsyms:: Used with *-c*, it overrides where to read the kallsyms file from. By default, /proc/kallsyms is used. *-k* will override the file to read the kallsyms from. This can be useful if the trace.dat file to create is from another machine. Just copy the /proc/kallsyms file locally, and use *-k* to point to that file. ... ] > Am unsure about this, but kprobes? (/jprobes/kretprobes), and by > extension, wrappers over this infra (like SystemTap)? > I (hazily) recollect a script I once wrote (years back though) that > collects kernel virtual addresses off of kallsyms for the purpose of > passing them to a 'helper' kernel module that uses kprobes. I realize > that 'modern' kprobes exposes APIs that just require the symbolic name > & that they're anyway at kernel privilege... but the point is, a > usermode script was picking up and passing the kernel addresses. > > Also, what about kernel addresses exposed via System.map? > Oh, just checked, it's root rw only.. pl ignore. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kaiwan N Billimoria Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl Date: Thu, 9 Nov 2017 10:24:32 +0530 Message-ID: References: <1510050731-32446-1-git-send-email-me@tobin.cc> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Laura Abbott , "Tobin C. Harding" , "kernel-hardening@lists.openwall.com" , "Jason A. Donenfeld" , "Theodore Ts'o" , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , To: Linus Torvalds Return-path: In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On Thu, Nov 9, 2017 at 10:13 AM, Kaiwan N Billimoria wrote: >> But I don't know if there is anything else than the profiling code >> that _really_ wants access to /proc/kallsyms in user space as a >> regular user. > Front-ends to ftrace, like trace-cmd? [from the trace-cmd git repo (Steve Rostedt, pl stand up, pl stand up :-) Documentation/trace-cmd-restore.1.txt : ... *-k* kallsyms:: Used with *-c*, it overrides where to read the kallsyms file from. By default, /proc/kallsyms is used. *-k* will override the file to read the kallsyms from. This can be useful if the trace.dat file to create is from another machine. Just copy the /proc/kallsyms file locally, and use *-k* to point to that file. ... ] > Am unsure about this, but kprobes? (/jprobes/kretprobes), and by > extension, wrappers over this infra (like SystemTap)? > I (hazily) recollect a script I once wrote (years back though) that > collects kernel virtual addresses off of kallsyms for the purpose of > passing them to a 'helper' kernel module that uses kprobes. I realize > that 'modern' kprobes exposes APIs that just require the symbolic name > & that they're anyway at kernel privilege... but the point is, a > usermode script was picking up and passing the kernel addresses. > > Also, what about kernel addresses exposed via System.map? > Oh, just checked, it's root rw only.. pl ignore. From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 In-Reply-To: References: <1510050731-32446-1-git-send-email-me@tobin.cc> From: Kaiwan N Billimoria Date: Thu, 9 Nov 2017 10:24:32 +0530 Message-ID: Content-Type: text/plain; charset="UTF-8" Subject: Re: [kernel-hardening] [PATCH v4] scripts: add leaking_addresses.pl To: Linus Torvalds Cc: Laura Abbott , "Tobin C. Harding" , "kernel-hardening@lists.openwall.com" , "Jason A. Donenfeld" , Theodore Ts'o , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , Linux Kernel Mailing List , Network Development , David Miller List-ID: On Thu, Nov 9, 2017 at 10:13 AM, Kaiwan N Billimoria wrote: >> But I don't know if there is anything else than the profiling code >> that _really_ wants access to /proc/kallsyms in user space as a >> regular user. > Front-ends to ftrace, like trace-cmd? [from the trace-cmd git repo (Steve Rostedt, pl stand up, pl stand up :-) Documentation/trace-cmd-restore.1.txt : ... *-k* kallsyms:: Used with *-c*, it overrides where to read the kallsyms file from. By default, /proc/kallsyms is used. *-k* will override the file to read the kallsyms from. This can be useful if the trace.dat file to create is from another machine. Just copy the /proc/kallsyms file locally, and use *-k* to point to that file. ... ] > Am unsure about this, but kprobes? (/jprobes/kretprobes), and by > extension, wrappers over this infra (like SystemTap)? > I (hazily) recollect a script I once wrote (years back though) that > collects kernel virtual addresses off of kallsyms for the purpose of > passing them to a 'helper' kernel module that uses kprobes. I realize > that 'modern' kprobes exposes APIs that just require the symbolic name > & that they're anyway at kernel privilege... but the point is, a > usermode script was picking up and passing the kernel addresses. > > Also, what about kernel addresses exposed via System.map? > Oh, just checked, it's root rw only.. pl ignore.