mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-31 16:38:12 +00:00
kptr_restrict for hiding kernel pointers from unprivileged users
Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict sysctl. The %pK format specifier is designed to hide exposed kernel pointers, specifically via /proc interfaces. Exposing these pointers provides an easy target for kernel write vulnerabilities, since they reveal the locations of writable structures containing easily triggerable function pointers. The behavior of %pK depends on the kptr_restrict sysctl. If kptr_restrict is set to 0, no deviation from the standard %p behavior occurs. If kptr_restrict is set to 1, the default, if the current user (intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG (currently in the LSM tree), kernel pointers using %pK are printed as 0's. If kptr_restrict is set to 2, kernel pointers using %pK are printed as 0's regardless of privileges. Replacing with 0's was chosen over the default "(null)", which cannot be parsed by userland %p, which expects "(nil)". [akpm@linux-foundation.org: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/] [akpm@linux-foundation.org: coding-style fixup] [randy.dunlap@oracle.com: fix kernel/sysctl.c warning] Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Cc: James Morris <jmorris@namei.org> Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Thomas Graf <tgraf@infradead.org> Cc: Eugene Teo <eugeneteo@kernel.org> Cc: Kees Cook <kees.cook@canonical.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: David S. Miller <davem@davemloft.net> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Eric Paris <eparis@parisplace.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
351f8f8e64
commit
455cd5ab30
4 changed files with 47 additions and 0 deletions
|
@ -34,6 +34,7 @@ show up in /proc/sys/kernel:
|
|||
- hotplug
|
||||
- java-appletviewer [ binfmt_java, obsolete ]
|
||||
- java-interpreter [ binfmt_java, obsolete ]
|
||||
- kptr_restrict
|
||||
- kstack_depth_to_print [ X86 only ]
|
||||
- l2cr [ PPC only ]
|
||||
- modprobe ==> Documentation/debugging-modules.txt
|
||||
|
@ -261,6 +262,19 @@ This flag controls the L2 cache of G3 processor boards. If
|
|||
|
||||
==============================================================
|
||||
|
||||
kptr_restrict:
|
||||
|
||||
This toggle indicates whether restrictions are placed on
|
||||
exposing kernel addresses via /proc and other interfaces. When
|
||||
kptr_restrict is set to (0), there are no restrictions. When
|
||||
kptr_restrict is set to (1), the default, kernel pointers
|
||||
printed using the %pK format specifier will be replaced with 0's
|
||||
unless the user has CAP_SYSLOG. When kptr_restrict is set to
|
||||
(2), kernel pointers printed using %pK will be replaced with 0's
|
||||
regardless of privileges.
|
||||
|
||||
==============================================================
|
||||
|
||||
kstack_depth_to_print: (X86 only)
|
||||
|
||||
Controls the number of words to print when dumping the raw
|
||||
|
|
|
@ -83,6 +83,7 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
|
|||
|
||||
extern int printk_delay_msec;
|
||||
extern int dmesg_restrict;
|
||||
extern int kptr_restrict;
|
||||
|
||||
/*
|
||||
* Print a one-time message (analogous to WARN_ONCE() et al):
|
||||
|
|
|
@ -24,6 +24,7 @@
|
|||
#include <linux/slab.h>
|
||||
#include <linux/sysctl.h>
|
||||
#include <linux/signal.h>
|
||||
#include <linux/printk.h>
|
||||
#include <linux/proc_fs.h>
|
||||
#include <linux/security.h>
|
||||
#include <linux/ctype.h>
|
||||
|
@ -710,6 +711,15 @@ static struct ctl_table kern_table[] = {
|
|||
.extra1 = &zero,
|
||||
.extra2 = &one,
|
||||
},
|
||||
{
|
||||
.procname = "kptr_restrict",
|
||||
.data = &kptr_restrict,
|
||||
.maxlen = sizeof(int),
|
||||
.mode = 0644,
|
||||
.proc_handler = proc_dointvec_minmax,
|
||||
.extra1 = &zero,
|
||||
.extra2 = &two,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.procname = "ngroups_max",
|
||||
|
|
|
@ -936,6 +936,8 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
|
|||
return string(buf, end, uuid, spec);
|
||||
}
|
||||
|
||||
int kptr_restrict = 1;
|
||||
|
||||
/*
|
||||
* Show a '%p' thing. A kernel extension is that the '%p' is followed
|
||||
* by an extra set of alphanumeric characters that are extended format
|
||||
|
@ -979,6 +981,7 @@ char *uuid_string(char *buf, char *end, const u8 *addr,
|
|||
* Implements a "recursive vsnprintf".
|
||||
* Do not use this feature without some mechanism to verify the
|
||||
* correctness of the format string and va_list arguments.
|
||||
* - 'K' For a kernel pointer that should be hidden from unprivileged users
|
||||
*
|
||||
* Note: The difference between 'S' and 'F' is that on ia64 and ppc64
|
||||
* function pointers are really function descriptors, which contain a
|
||||
|
@ -1035,6 +1038,25 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
|
|||
return buf + vsnprintf(buf, end - buf,
|
||||
((struct va_format *)ptr)->fmt,
|
||||
*(((struct va_format *)ptr)->va));
|
||||
case 'K':
|
||||
/*
|
||||
* %pK cannot be used in IRQ context because its test
|
||||
* for CAP_SYSLOG would be meaningless.
|
||||
*/
|
||||
if (in_irq() || in_serving_softirq() || in_nmi()) {
|
||||
if (spec.field_width == -1)
|
||||
spec.field_width = 2 * sizeof(void *);
|
||||
return string(buf, end, "pK-error", spec);
|
||||
} else if ((kptr_restrict == 0) ||
|
||||
(kptr_restrict == 1 &&
|
||||
has_capability_noaudit(current, CAP_SYSLOG)))
|
||||
break;
|
||||
|
||||
if (spec.field_width == -1) {
|
||||
spec.field_width = 2 * sizeof(void *);
|
||||
spec.flags |= ZEROPAD;
|
||||
}
|
||||
return number(buf, end, 0, spec);
|
||||
}
|
||||
spec.flags |= SMALL;
|
||||
if (spec.field_width == -1) {
|
||||
|
|
Loading…
Reference in a new issue