From patchwork Tue Dec 19 21:39:22 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tobin Harding X-Patchwork-Id: 10124523 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9B7C86057F for ; Tue, 19 Dec 2017 21:40:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8D55C28A46 for ; Tue, 19 Dec 2017 21:40:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8159528A5B; Tue, 19 Dec 2017 21:40:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A818C28A4E for ; Tue, 19 Dec 2017 21:40:04 +0000 (UTC) Received: (qmail 21652 invoked by uid 550); 19 Dec 2017 21:40:00 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 20466 invoked from network); 19 Dec 2017 21:39:59 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tobin.cc; h=cc :date:from:in-reply-to:message-id:references:subject:to :x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=b8lYCsf/ABksvvZSA /mfwoINlRtDjcnj6dH9GaMwY9w=; b=OOk5ZvMhC6STyE0zDpYzQBKYl5Bfl6jD9 pfHMBpNpGvMm48NUx5Wi92D2dn/yJaYKA7ljGTQfk3D+gjeZT238dT1TFjvpZwdf i1nnap6WzlqwDmcxcabmlOJIN9IHGANOCtlldIUjQrDCgU+Wsn+CJkyui1O4O924 TU4Vt2VQSSvzaeM9f6RA5WzjceOCPI9ZGMlhUoty3W0qYF9Q0DZ6oy4IgdFzv7Ka +leUbd0lL91TGAn5cepA+DQs3JH/dNE/qFlOVD4HVYKtB3XQ5UWbwIh/8FhW3/3/ sGcDxov/B48HEozaEKyiql+NhXRI1+36rk0ETdkNpBDuHgge4e96A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:date:from:in-reply-to:message-id :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; bh=b8lYCsf/ABksvvZSA/mfwoINlRtDjcnj6dH9GaMwY9w=; b=WfNwrBmh pNYeMmTGIeTnv8cMSz3z6gY6Jn3MklcqV6Sm0uTd5BC4MHOg8pufuGAldd0VFlSw +kTyLw+3fQQZmmCpGdiWi4jLJRJDo/WM2GqGw7jFAbBKp4jbYmxBzJxNKTKuqgEG 02JWBXatMJjXdlyUanHGeRmzFqnfvqCtLNlJt+xy4vNjahEXz+LO0QM/XDJBZaxF RuQx193GtE6tWqEqT1xgb14FYEmkIodA67Ci4vp66Xq496QlK0vTu4XUTXRSQhud 2kZACsatAQkJofi7mtNg1kW1crsEdpfXwunZ3fYs/cOiG5Isce5W9ptd0ZJ5UOsZ A0OZEKfc/VXLLQ== X-ME-Sender: From: "Tobin C. Harding" To: kernel-hardening@lists.openwall.com Cc: "Tobin C. Harding" , Steven Rostedt , Tycho Andersen , Linus Torvalds , Kees Cook , Andrew Morton , Daniel Borkmann , Masahiro Yamada , Alexei Starovoitov , linux-kernel@vger.kernel.org, Network Development , Joe Perches Date: Wed, 20 Dec 2017 08:39:22 +1100 Message-Id: <1513719564-13249-2-git-send-email-me@tobin.cc> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1513719564-13249-1-git-send-email-me@tobin.cc> References: <1513719564-13249-1-git-send-email-me@tobin.cc> Subject: [kernel-hardening] [PATCH v3 1/3] kallsyms: don't leak address when symbol not found X-Virus-Scanned: ClamAV using ClamSMTP Currently if kallsyms_lookup() fails to find the symbol then the address is printed. This potentially leaks sensitive information but is useful for debugging. We would like to stop the leak but keep the current behaviour when needed for debugging. To achieve this we can add a command-line parameter that if enabled maintains the current behaviour. If the command-line parameter is not enabled we can return an error instead of printing the address giving the calling code the option of how to handle the look up failure. Add command-line parameter 'insecure_print_all_symbols'. If parameter is not enabled return an error value instead of printing the raw address. Signed-off-by: Tobin C. Harding --- kernel/kallsyms.c | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index d5fa4116688a..2707cf751437 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -383,6 +383,16 @@ int lookup_symbol_attrs(unsigned long addr, unsigned long *size, return lookup_module_symbol_attrs(addr, size, offset, modname, name); } +/* Enables printing of raw address when symbol look up fails */ +static bool insecure_print_all_symbols; + +static int __init enable_insecure_print_all_symbols(char *unused) +{ + insecure_print_all_symbols = true; + return 0; +} +early_param("insecure_print_all_symbols", enable_insecure_print_all_symbols); + /* Look up a kernel symbol and return it in a text buffer. */ static int __sprint_symbol(char *buffer, unsigned long address, int symbol_offset, int add_offset) @@ -394,8 +404,15 @@ static int __sprint_symbol(char *buffer, unsigned long address, address += symbol_offset; name = kallsyms_lookup(address, &size, &offset, &modname, buffer); - if (!name) - return sprintf(buffer, "0x%lx", address - symbol_offset); + if (insecure_print_all_symbols) { + if (!name) + return sprintf(buffer, "0x%lx", address - symbol_offset); + } else { + if (!name) { + buffer[0] = '\0'; + return -1; + } + } if (name != buffer) strcpy(buffer, name); @@ -417,8 +434,9 @@ static int __sprint_symbol(char *buffer, unsigned long address, * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name, - * offset, size and module name to @buffer if possible. If no symbol was found, - * just saves its @address as is. + * offset, size and module name to @buffer if possible. If no symbol was found + * returns -1 unless kernel command-line parameter 'insecure_print_all_symbols' + * is enabled, in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */ @@ -434,8 +452,9 @@ EXPORT_SYMBOL_GPL(sprint_symbol); * @address: address to lookup * * This function looks up a kernel symbol with @address and stores its name - * and module name to @buffer if possible. If no symbol was found, just saves - * its @address as is. + * and module name to @buffer if possible. If no symbol was found, returns -1 + * unless kernel command-line parameter 'insecure_print_all_symbols' is enabled, + * in which case saves @address as is to buffer. * * This function returns the number of bytes stored in @buffer. */