From patchwork Tue Dec 19 03:28:12 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tobin Harding X-Patchwork-Id: 10122133 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7A76860390 for ; Tue, 19 Dec 2017 03:28:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6C5EC22A65 for ; Tue, 19 Dec 2017 03:28:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 60DC628EF5; Tue, 19 Dec 2017 03:28:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 5FA3E28EE5 for ; Tue, 19 Dec 2017 03:28:48 +0000 (UTC) Received: (qmail 16058 invoked by uid 550); 19 Dec 2017 03:28:44 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 15893 invoked from network); 19 Dec 2017 03:28:43 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tobin.cc; h=cc :date:from:in-reply-to:message-id:references:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=b8lYCsf/ABksvvZSA /mfwoINlRtDjcnj6dH9GaMwY9w=; b=Bv9F+X/N9qLNmCQOm+ku7fX7XnTde9Ndi VP7Oz2GaHphFq4OmN/QUCXNrtvHPx4Aw32qBueRLt3QTspEwKFZAmFCcHjClRsnH cE5DEWG5i6prr/N2Y8/ottAcfCqe8KVQXVpj0dpAuvOleA5N4AiaFseILsDo32MN pehbLVgJm51OD5NYS9dh49s76m+qPG7do6RE/nc5rRj8pD68UGRFtBaIaFSj4DQQ GBy+DD3IaWsNuoowpr9ZNC2INRg5H691Aycv8qtQwPkNiB7IUkJjCQX115vMLuI2 0F3fBJk0i8CkTv0slOIjsI8qLb6Saj+rebUQR8KsO7F565jQYBsYQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:date:from:in-reply-to:message-id :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; bh=b8lYCsf/ABksvvZSA/mfwoINlRtDjcnj6dH9GaMwY9w=; b=EZHiFA8g gJuyDu271sacaAnmmETyMBYJzHndBRJKeYiHhYQO1qlVE8sGk4F8AWwjx/BfSFL4 vCU1bjUdBuCd5zwjksXq5pnYFiR8X9lwuF+Nm2XgGBuTgAsWRqDlQAdLRTXvo1cX ta1RwzqZ9O+6rfm7Y/0/horZojYF9kQepVj0Dowgwyh+IjKy1E4p21k7oOSnnMld 4w3XWETSFXkb+FFObF6npXh0CnD5Bal3n9jfAbz5nfqdI3cvEC94uSk+Vj7de2rR 0Rf561XL6r6FtY7dVks0dYtaIRVr7/yfRDJ9yZWE64wNY2OugJI0kB93acTFUqJY 2ZZJNQDueND2aA== X-ME-Sender: From: "Tobin C. Harding" To: kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" , Steven Rostedt , Tycho Andersen , Linus Torvalds , Kees Cook , Andrew Morton , Daniel Borkmann , Masahiro Yamada , Alexei Starovoitov , linux-kernel@vger.kernel.org, Network Development Date: Tue, 19 Dec 2017 14:28:12 +1100 Message-Id: <1513654094-16832-2-git-send-email-me@tobin.cc> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1513654094-16832-1-git-send-email-me@tobin.cc> References: <1513654094-16832-1-git-send-email-me@tobin.cc> Subject: [kernel-hardening] [PATCH v2 1/3] kallsyms: don't leak address when symbol not found X-Virus-Scanned: ClamAV using ClamSMTP Currently if kallsyms_lookup() fails to find the symbol then the address is printed. This potentially leaks sensitive information but is useful for debugging. We would like to stop the leak but keep the current behaviour when needed for debugging. To achieve this we can add a command-line parameter that if enabled maintains the current behaviour. If the command-line parameter is not enabled we can return an error instead of printing the address giving the calling code the option of how to handle the look up failure. Add command-line parameter 'insecure_print_all_symbols'. If parameter is not enabled return an error value instead of printing the raw address. Signed-off-by: Tobin C. Harding --- kernel/kallsyms.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index d5fa4116688a..2707cf751437 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -383,6 +383,16 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size, return lookup_module_symbol_attrs(addr, size, offset, modname, name); } +/* Enables printing of raw address when symbol look up fails */ +static bool insecure_print_all_symbols; + +static int __init enable_insecure_print_all_symbols(char *unused) +{ + insecure_print_all_symbols = true; + return 0; +} +early_param("insecure_print_all_symbols", enable_insecure_print_all_symbols); + /* Look up a kernel symbol and return it in a text buffer. */ static int __sprint_symbol(char *buffer, unsigned long address, int symbol_offset, int add_offset) @@ -394,8 +404,15 @@ static int __sprint_symbol(char *buffer, unsigned long address, address += symbol_offset; name = kallsyms_lookup(address, &size, &offset, &modname, buffer); - if (!name) - return sprintf(buffer, "0x%lx", address - symbol_offset); + if (insecure_print_all_symbols) { + if (!name) + return sprintf(buffer, "0x%lx", address - symbol_offset); + } else { + if (!name) { + buffer[0] = '\0'; + return -1; + } + } if (name != buffer) strcpy(buffer, name); @@ -417,8 +434,9 @@ static int __sprint_symbol(char *buffer, unsigned long address, * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name, - * offset, size and module name to @buffer if possible. If no symbol was found, - * just saves its @address as is. + * offset, size and module name to @buffer if possible. If no symbol was found + * returns -1 unless kernel command-line parameter 'insecure_print_all_symbols' + * is enabled, in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ @@ -434,8 +452,9 @@ EXPORT_SYMBOL_GPL(sprint_symbol); * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name - * and module name to @buffer if possible. If no symbol was found, just saves - * its @address as is. + * and module name to @buffer if possible. If no symbol was found, returns -1 + * unless kernel command-line parameter 'insecure_print_all_symbols' is enabled, + * in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */