linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Linus Torvalds <torvalds@linux-foundation.org>
To: Michael Ellerman <mpe@ellerman.id.au>
Cc: Andy Shevchenko <andy.shevchenko@gmail.com>,
	Kees Cook <keescook@chromium.org>,
	"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>,
	David Laight <David.Laight@aculab.com>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"mingo@kernel.org" <mingo@kernel.org>,
	"jiangshanlai@gmail.com" <jiangshanlai@gmail.com>,
	"dipankar@in.ibm.com" <dipankar@in.ibm.com>,
	"akpm@linux-foundation.org" <akpm@linux-foundation.org>,
	"mathieu.desnoyers@efficios.com" <mathieu.desnoyers@efficios.com>,
	"josh@joshtriplett.org" <josh@joshtriplett.org>,
	"tglx@linutronix.de" <tglx@linutronix.de>,
	"peterz@infradead.org" <peterz@infradead.org>,
	"rostedt@goodmis.org" <rostedt@goodmis.org>,
	"dhowells@redhat.com" <dhowells@redhat.com>,
	"edumazet@google.com" <edumazet@google.com>,
	"fweisbec@gmail.com" <fweisbec@gmail.com>,
	"oleg@redhat.com" <oleg@redhat.com>,
	"kernel-hardening@lists.openwall.com" 
	<kernel-hardening@lists.openwall.com>,
	"Tobin C. Harding" <me@tobin.cc>
Subject: Re: Long live %pK (was Re: [PATCH tip/core/rcu 02/20] torture: Prepare scripting for shift from %p to %pK)
Date: Wed, 13 Dec 2017 10:21:27 -0800	[thread overview]
Message-ID: <CA+55aFxkPYaa6vt-wH_M6kfgMHgOizakfGQe0o10QDPncwiOiw@mail.gmail.com> (raw)
In-Reply-To: <87r2ryaim5.fsf@concordia.ellerman.id.au>

On Wed, Dec 13, 2017 at 4:59 AM, Michael Ellerman <mpe@ellerman.id.au> wrote:
>
> Right. My email was only about the kptr_restrict = 1 case, but I didn't
> actually make that clear.
>
> But that's also sort of my point, it has multiple modes of operation,
> which is useful.

No it isn't.

It's completely useless. Let me count the ways:

 - it ties a lot of completely unrelated things together in illogical
ways. What if you want vmallocinfo for debuggability, but not
something else?

 - we've had it for most of a decade, and few people use it, and it's
not actually fixed any real security holes. It has only helped on
particular setups, not in general.

> OK, that's the piece I was missing - ie. what to do in the case where
> %px for all users is too permissive but %p is not useful.

Right. THAT IS THE WHOLE POINT OF THE NEW %p BEHAVIOR.

Make people actually _think_ about the things they see, and hopefully
just remove it entirely. Not the total idiocy that was %pK that never
resulted in any actual improvement anywhere.

%pK was the "sprinkle some crack on him, let's get out of here"
approach to security. It's bogus shit. Don't do it.

Seriously. It's been sprinkled around randomly just to make random
people feel like they did something. IT DID NOTHING.

The 'K' literally stands for "krack". Because spelling wasn't the
strong part of the thing either.

> I'm still a bit confused by the above. Because kallsyms which is your
> example of how to do it right, still uses kptr_restrict. I get that it
> also checks kallsyms_for_perf(), but that's only in the
> kptr_restrict = 0 case.

Yeah, it was probably a mistake, but I didn't want to change the old behavior.

> Anyway, I'll do a patch for vmallocinfo to do the CAP_SYSLOG check at
> open time, and use that to decide if it should print 0 or the address.

.. don't use CAP_SYSLOG, at least without thihnking about it.  That
was just another mistake of mine in thinking that "let's keep the old
behavior" is a good idea.

Seriously, what does CAP_SYSLOG have to do with kernel address
debugging? Nothing, really.

I suspect CAP_SYS_ADMIN is a much saner thing to use.

Ask yourself: who really should get access to vmalloc addresses?

                 Linus

  reply	other threads:[~2017-12-13 18:21 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-12-01 20:08 [PATCH tip/core/rcu 0/20] Torture-test updates for v4.16 Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 01/20] torture: Suppress CPU stall warnings during shutdown ftrace dump Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 02/20] torture: Prepare scripting for shift from %p to %pK Paul E. McKenney
2017-12-04 12:32   ` David Laight
2017-12-04 13:42     ` Paul E. McKenney
2017-12-04 14:13       ` David Laight
2017-12-04 16:11         ` Paul E. McKenney
2017-12-10 12:52           ` Andy Shevchenko
2017-12-10 18:51             ` Paul E. McKenney
2017-12-10 20:39             ` Linus Torvalds
2017-12-10 21:47               ` Paul E. McKenney
2017-12-11 19:59                 ` Kees Cook
2017-12-12 16:08                   ` Paul E. McKenney
     [not found]               ` <87wp1sa55h.fsf@concordia.ellerman.id.au>
     [not found]                 ` <CA+55aFxHdAX_ztDMUyXihhUv_eftntHecGUUaV3qAtGj_ZbKCg@mail.gmail.com>
2017-12-13 12:59                   ` Long live %pK (was Re: [PATCH tip/core/rcu 02/20] torture: Prepare scripting for shift from %p to %pK) Michael Ellerman
2017-12-13 18:21                     ` Linus Torvalds [this message]
2017-12-01 20:08 ` [PATCH tip/core/rcu 03/20] rcutorture: Change printk() %p to %pK Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 04/20] torture: Reduce #ifdefs for preempt_schedule() Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 05/20] rcutorture: Preempt RCU-preempt readers more vigorously Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 06/20] rcutorture/configinit: Fix build directory error message Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 07/20] rcutorture: Remove unused script, config2frag.sh Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 08/20] rcutorture/kvm.sh: Remove unused variable, `alldone` Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 09/20] rcutorture/kvm.sh: Use consistent help text for --qemu-args Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 10/20] rcutorture/kvm.sh: Support execution from any directory Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 11/20] rcutorture/kvm-recheck-*: Improve result directory readability check Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 12/20] rcutorture: Simplify logging Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 13/20] rcutorture: Simplify functions.sh include path Paul E. McKenney
2017-12-01 20:08 ` [PATCH tip/core/rcu 14/20] rcutorture/kvm-build.sh: Skip build directory check Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 15/20] torture: Place all torture-test modules in one MAINTAINERS group Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 16/20] locking/locktorture: Fix rwsem reader_delay Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 17/20] locking/locktorture: Fix num reader/writer corner cases Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 18/20] torture: Make stutter less vulnerable to compilers and races Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 19/20] torture: Eliminate torture_runnable and perf_runnable Paul E. McKenney
2017-12-01 20:09 ` [PATCH tip/core/rcu 20/20] torture: Save a line in stutter_wait(): while -> for Paul E. McKenney

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CA+55aFxkPYaa6vt-wH_M6kfgMHgOizakfGQe0o10QDPncwiOiw@mail.gmail.com \
    --to=torvalds@linux-foundation.org \
    --cc=David.Laight@aculab.com \
    --cc=akpm@linux-foundation.org \
    --cc=andy.shevchenko@gmail.com \
    --cc=dhowells@redhat.com \
    --cc=dipankar@in.ibm.com \
    --cc=edumazet@google.com \
    --cc=fweisbec@gmail.com \
    --cc=jiangshanlai@gmail.com \
    --cc=josh@joshtriplett.org \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=me@tobin.cc \
    --cc=mingo@kernel.org \
    --cc=mpe@ellerman.id.au \
    --cc=oleg@redhat.com \
    --cc=paulmck@linux.vnet.ibm.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=tglx@linutronix.de \
    --subject='Re: Long live %pK (was Re: [PATCH tip/core/rcu 02/20] torture: Prepare scripting for shift from %p to %pK)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).