From: "Tobin C. Harding" <me@tobin.cc> To: kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" <me@tobin.cc>, Steven Rostedt <rostedt@goodmis.org>, Tycho Andersen <tycho@tycho.ws>, Linus Torvalds <torvalds@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Andrew Morton <akpm@linux-foundation.org>, Daniel Borkmann <daniel@iogearbox.net>, Masahiro Yamada <yamada.masahiro@socionext.com>, Alexei Starovoitov <ast@kernel.org>, linux-kernel@vger.kernel.org, Network Development <netdev@vger.kernel.org> Subject: [PATCH v2 1/3] kallsyms: don't leak address when symbol not found Date: Tue, 19 Dec 2017 14:28:12 +1100 [thread overview] Message-ID: <1513654094-16832-2-git-send-email-me@tobin.cc> (raw) In-Reply-To: <1513654094-16832-1-git-send-email-me@tobin.cc> Currently if kallsyms_lookup() fails to find the symbol then the address is printed. This potentially leaks sensitive information but is useful for debugging. We would like to stop the leak but keep the current behaviour when needed for debugging. To achieve this we can add a command-line parameter that if enabled maintains the current behaviour. If the command-line parameter is not enabled we can return an error instead of printing the address giving the calling code the option of how to handle the look up failure. Add command-line parameter 'insecure_print_all_symbols'. If parameter is not enabled return an error value instead of printing the raw address. Signed-off-by: Tobin C. Harding <me@tobin.cc> --- kernel/kallsyms.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index d5fa4116688a..2707cf751437 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -383,6 +383,16 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size, return lookup_module_symbol_attrs(addr, size, offset, modname, name); } +/* Enables printing of raw address when symbol look up fails */ +static bool insecure_print_all_symbols; + +static int __init enable_insecure_print_all_symbols(char *unused) +{ + insecure_print_all_symbols = true; + return 0; +} +early_param("insecure_print_all_symbols", enable_insecure_print_all_symbols); + /* Look up a kernel symbol and return it in a text buffer. */ static int __sprint_symbol(char *buffer, unsigned long address, int symbol_offset, int add_offset) @@ -394,8 +404,15 @@ static int __sprint_symbol(char *buffer, unsigned long address, address += symbol_offset; name = kallsyms_lookup(address, &size, &offset, &modname, buffer); - if (!name) - return sprintf(buffer, "0x%lx", address - symbol_offset); + if (insecure_print_all_symbols) { + if (!name) + return sprintf(buffer, "0x%lx", address - symbol_offset); + } else { + if (!name) { + buffer[0] = '\0'; + return -1; + } + } if (name != buffer) strcpy(buffer, name); @@ -417,8 +434,9 @@ static int __sprint_symbol(char *buffer, unsigned long address, * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name, - * offset, size and module name to @buffer if possible. If no symbol was found, - * just saves its @address as is. + * offset, size and module name to @buffer if possible. If no symbol was found + * returns -1 unless kernel command-line parameter 'insecure_print_all_symbols' + * is enabled, in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ @@ -434,8 +452,9 @@ EXPORT_SYMBOL_GPL(sprint_symbol); * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name - * and module name to @buffer if possible. If no symbol was found, just saves - * its @address as is. + * and module name to @buffer if possible. If no symbol was found, returns -1 + * unless kernel command-line parameter 'insecure_print_all_symbols' is enabled, + * in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ -- 2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: "Tobin C. Harding" <me@tobin.cc> To: kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" <me@tobin.cc>, Steven Rostedt <rostedt@goodmis.org>, Tycho Andersen <tycho@tycho.ws>, Linus Torvalds <torvalds@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Andrew Morton <akpm@linux-foundation.org>, Daniel Borkmann <daniel@iogearbox.net>, Masahiro Yamada <yamada.masahiro@socionext.com>, Alexei Starovoitov <ast@kernel.org>, linux-kernel@vger.kernel.org, Network Development <netdev@vger.kernel.org> Subject: [kernel-hardening] [PATCH v2 1/3] kallsyms: don't leak address when symbol not found Date: Tue, 19 Dec 2017 14:28:12 +1100 [thread overview] Message-ID: <1513654094-16832-2-git-send-email-me@tobin.cc> (raw) In-Reply-To: <1513654094-16832-1-git-send-email-me@tobin.cc> Currently if kallsyms_lookup() fails to find the symbol then the address is printed. This potentially leaks sensitive information but is useful for debugging. We would like to stop the leak but keep the current behaviour when needed for debugging. To achieve this we can add a command-line parameter that if enabled maintains the current behaviour. If the command-line parameter is not enabled we can return an error instead of printing the address giving the calling code the option of how to handle the look up failure. Add command-line parameter 'insecure_print_all_symbols'. If parameter is not enabled return an error value instead of printing the raw address. Signed-off-by: Tobin C. Harding <me@tobin.cc> --- kernel/kallsyms.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index d5fa4116688a..2707cf751437 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -383,6 +383,16 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size, return lookup_module_symbol_attrs(addr, size, offset, modname, name); } +/* Enables printing of raw address when symbol look up fails */ +static bool insecure_print_all_symbols; + +static int __init enable_insecure_print_all_symbols(char *unused) +{ + insecure_print_all_symbols = true; + return 0; +} +early_param("insecure_print_all_symbols", enable_insecure_print_all_symbols); + /* Look up a kernel symbol and return it in a text buffer. */ static int __sprint_symbol(char *buffer, unsigned long address, int symbol_offset, int add_offset) @@ -394,8 +404,15 @@ static int __sprint_symbol(char *buffer, unsigned long address, address += symbol_offset; name = kallsyms_lookup(address, &size, &offset, &modname, buffer); - if (!name) - return sprintf(buffer, "0x%lx", address - symbol_offset); + if (insecure_print_all_symbols) { + if (!name) + return sprintf(buffer, "0x%lx", address - symbol_offset); + } else { + if (!name) { + buffer[0] = '\0'; + return -1; + } + } if (name != buffer) strcpy(buffer, name); @@ -417,8 +434,9 @@ static int __sprint_symbol(char *buffer, unsigned long address, * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name, - * offset, size and module name to @buffer if possible. If no symbol was found, - * just saves its @address as is. + * offset, size and module name to @buffer if possible. If no symbol was found + * returns -1 unless kernel command-line parameter 'insecure_print_all_symbols' + * is enabled, in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ @@ -434,8 +452,9 @@ EXPORT_SYMBOL_GPL(sprint_symbol); * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name - * and module name to @buffer if possible. If no symbol was found, just saves - * its @address as is. + * and module name to @buffer if possible. If no symbol was found, returns -1 + * unless kernel command-line parameter 'insecure_print_all_symbols' is enabled, + * in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ -- 2.7.4
next prev parent reply other threads:[~2017-12-19 3:28 UTC|newest] Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-12-19 3:28 [PATCH v2 0/3] kallsyms: don't leak address Tobin C. Harding 2017-12-19 3:28 ` [kernel-hardening] " Tobin C. Harding 2017-12-19 3:28 ` Tobin C. Harding [this message] 2017-12-19 3:28 ` [kernel-hardening] [PATCH v2 1/3] kallsyms: don't leak address when symbol not found Tobin C. Harding 2017-12-19 3:28 ` [PATCH v2 2/3] vsprintf: print <no-symbol> if " Tobin C. Harding 2017-12-19 3:28 ` [kernel-hardening] " Tobin C. Harding 2017-12-19 6:18 ` Joe Perches 2017-12-19 6:18 ` [kernel-hardening] " Joe Perches 2017-12-19 6:33 ` Tobin C. Harding 2017-12-19 6:33 ` [kernel-hardening] " Tobin C. Harding 2017-12-19 3:28 ` [PATCH v2 3/3] trace: print address " Tobin C. Harding 2017-12-19 3:28 ` [kernel-hardening] " Tobin C. Harding
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1513654094-16832-2-git-send-email-me@tobin.cc \ --to=me@tobin.cc \ --cc=akpm@linux-foundation.org \ --cc=ast@kernel.org \ --cc=daniel@iogearbox.net \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=rostedt@goodmis.org \ --cc=torvalds@linux-foundation.org \ --cc=tycho@tycho.ws \ --cc=yamada.masahiro@socionext.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.