From: Kees Cook <keescook@chromium.org>
To: Dominik Czarnota <dominik.czarnota@trailofbits.com>
Cc: Kees Cook <keescook@chromium.org>,
stable@vger.kernel.org, Jessica Yu <jeyu@kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Andrew Morton <akpm@linux-foundation.org>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
Yonghong Song <yhs@fb.com>, Andrii Nakryiko <andriin@fb.com>,
KP Singh <kpsingh@chromium.org>,
"Naveen N. Rao" <naveen.n.rao@linux.ibm.com>,
Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
"David S. Miller" <davem@davemloft.net>,
Masami Hiramatsu <mhiramat@kernel.org>,
Jakub Kicinski <kuba@kernel.org>,
"Steven Rostedt (VMware)" <rostedt@goodmis.org>,
Dmitry Safonov <0x7f454c46@gmail.com>,
Will Deacon <will@kernel.org>,
Alexey Dobriyan <adobriyan@gmail.com>,
Marc Zyngier <maz@kernel.org>,
Masahiro Yamada <masahiroy@kernel.org>,
Al Viro <viro@zeniv.linux.org.uk>,
Matteo Croce <mcroce@redhat.com>,
Edward Cree <ecree@solarflare.com>,
Nicolas Dichtel <nicolas.dichtel@6wind.com>,
Alexander Lobakin <alobakin@dlink.ru>,
Thomas Richter <tmricht@linux.ibm.com>,
Ingo Molnar <mingo@kernel.org>,
netdev@vger.kernel.org, bpf@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [PATCH 3/5] module: Do not expose section addresses to non-CAP_SYSLOG
Date: Thu, 2 Jul 2020 16:26:36 -0700 [thread overview]
Message-ID: <20200702232638.2946421-4-keescook@chromium.org> (raw)
In-Reply-To: <20200702232638.2946421-1-keescook@chromium.org>
The printing of section addresses in /sys/module/*/sections/* was not
using the correct credentials to evaluate visibility.
Before:
# cat /sys/module/*/sections/.*text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0xffffffffc0458000
...
After:
# cat /sys/module/*/sections/*.text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0x0000000000000000
...
Additionally replaces the existing (safe) /proc/modules check with
file->f_cred for consistency.
Cc: stable@vger.kernel.org
Reported-by: Dominik Czarnota <dominik.czarnota@trailofbits.com>
Fixes: be71eda5383f ("module: Fix display of wrong module .text address")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
kernel/module.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/module.c b/kernel/module.c
index 9e2954519259..e6c7571092cb 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1530,8 +1530,8 @@ static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
if (pos != 0)
return -EINVAL;
- return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
- (void *)sattr->address : NULL);
+ return sprintf(buf, "0x%px\n",
+ kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL);
}
static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
@@ -4380,7 +4380,7 @@ static int modules_open(struct inode *inode, struct file *file)
if (!err) {
struct seq_file *m = file->private_data;
- m->private = kallsyms_show_value(current_cred()) ? NULL : (void *)8ul;
+ m->private = kallsyms_show_value(file->f_cred) ? NULL : (void *)8ul;
}
return err;
--
2.25.1
next prev parent reply other threads:[~2020-07-02 23:26 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-02 23:26 [PATCH 0/5] Refactor kallsyms_show_value() users for correct cred Kees Cook
2020-07-02 23:26 ` [PATCH 1/5] kallsyms: Refactor kallsyms_show_value() to take cred Kees Cook
2020-07-02 23:26 ` [PATCH 2/5] module: Refactor section attr into bin attribute Kees Cook
2020-07-03 6:02 ` Greg Kroah-Hartman
2020-07-03 15:29 ` Kees Cook
2020-07-08 16:10 ` Jessica Yu
2020-07-02 23:26 ` Kees Cook [this message]
2020-07-08 16:12 ` [PATCH 3/5] module: Do not expose section addresses to non-CAP_SYSLOG Jessica Yu
2020-07-02 23:26 ` [PATCH 4/5] kprobes: Do not expose probe " Kees Cook
2020-07-03 1:00 ` Linus Torvalds
2020-07-03 15:13 ` Kees Cook
2020-07-03 15:50 ` Kees Cook
2020-07-05 20:10 ` Linus Torvalds
2020-07-05 20:19 ` Kees Cook
2020-07-10 14:09 ` Masami Hiramatsu
2020-07-02 23:26 ` [PATCH 5/5] bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok() Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200702232638.2946421-4-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=0x7f454c46@gmail.com \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=alobakin@dlink.ru \
--cc=andriin@fb.com \
--cc=anil.s.keshavamurthy@intel.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dominik.czarnota@trailofbits.com \
--cc=ecree@solarflare.com \
--cc=gregkh@linuxfoundation.org \
--cc=jeyu@kernel.org \
--cc=kafai@fb.com \
--cc=kpsingh@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=maz@kernel.org \
--cc=mcroce@redhat.com \
--cc=mhiramat@kernel.org \
--cc=mingo@kernel.org \
--cc=naveen.n.rao@linux.ibm.com \
--cc=netdev@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=rostedt@goodmis.org \
--cc=songliubraving@fb.com \
--cc=stable@vger.kernel.org \
--cc=tmricht@linux.ibm.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).