From patchwork Tue Nov 7 21:22:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10047263 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id CD7926032D for ; Tue, 7 Nov 2017 21:22:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C3BF929112 for ; Tue, 7 Nov 2017 21:22:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B851B2937B; Tue, 7 Nov 2017 21:22:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id AEC0B29370 for ; Tue, 7 Nov 2017 21:22:29 +0000 (UTC) Received: (qmail 32018 invoked by uid 550); 7 Nov 2017 21:22:27 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 31991 invoked from network); 7 Nov 2017 21:22:26 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=G45T6L+prWI3QHDW2+2oa6RdTxbNsdoH6eGCrzP6HYU=; b=XB86ayIv8v8PmtEyTufxfZXsLyrITyIw1aTDc4J18qioOCHWQ+irVVdSFW6r0fOkpd Gp9n8yooMoSAyECeVEsThKssu19ZsYwgaPb31DiBYmU1d+1L0SvR+DA1TnCbT/9b1D8G jkwee0LrFTJAQqGKSJvneO6l11m7VqY7smAl8IjkXDzvmhQyGvFm7E1AcTq3BDh+ZLpP w9/KPfHdwcBrKW5a3PF9geb1wJ1TDTXmzn8m+h7bhGK3BRsP3DHc0FL3ILB5HF+9ca12 JvTLPRQ57ydHK/Fv3rVWfhOHG14fy8O9JbNfncmsbRmGF2GPS9no5xeNKvmv43gpfKm/ gonw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=G45T6L+prWI3QHDW2+2oa6RdTxbNsdoH6eGCrzP6HYU=; b=oFC7lyQz98vJkbGRcJPhW8dj7cGcsp52nYeLY1cr7LgJwqIKY8cId/bBqJ732bYP6B 2E4gvqmIFlmV7cNIAcmk/zJ0zVDBuiO8GQ6d+F7UZf1VtXRmJc2BPDHVAiZtgInAhBva vhTpFcpvR+ocvh2Pv1l2CjrF5UGwW2x6sOfHE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=G45T6L+prWI3QHDW2+2oa6RdTxbNsdoH6eGCrzP6HYU=; b=H9ARst0A+YujolHd/RkeFZ7++F+FheEyis+RxmDiXpQ5gHaa4l6pzDf8IqbsBiMhwJ pzKodVaDUjRPZaEaikF1ABhKK7xfRbg6Sb3U/Q2lf/HqlxZTlr7XqOARrh+qCy5vtvOK jHpgblk7MYjnB0Z2PVwc+R0EvLWUjBrr4biLE5LJGM8vywCOTamevgNdOloDkHrTcBK6 Iea5Fj+UpePAWwgFc87qsQSZ3oxMVDiTL+/EjwWHPtF5GplqUb7WGoDGCHjf8q82w7aA zlWM0eqOBmmLQQCL7duOCsGRc6iOT4QJ0Q6wQCXsNWvHD6SJExS+aStzqbBmzpMR9xgb 0JQw== X-Gm-Message-State: AJaThX7YRH5jrO3kPIfUkgD+/GMgxhuoSweCSJiK2UMPiQQ7awXVXHWW 6RGVZzkyQkECE8GjEEBdQYtWaepfs315aNQZm/DdNA== X-Google-Smtp-Source: ABhQp+RVYGLvUvs1Eis5qbKpkEG9Qx8cBXVdFJHe8AiwM4KPAF723OIt9EeiPP6OnMslZ7dlanttwfMKJOtxNbzjjrI= X-Received: by 10.36.169.75 with SMTP id x11mr891155iti.60.1510089734237; Tue, 07 Nov 2017 13:22:14 -0800 (PST) MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: References: <1509945567-11801-1-git-send-email-me@tobin.cc> From: Kees Cook Date: Tue, 7 Nov 2017 13:22:13 -0800 X-Google-Sender-Auth: 6zJXFi5_-mRQJ5cA4ULD3MZOTyU Message-ID: To: Linus Torvalds , "Tobin C. Harding" , "Paul E. McKenney" , Andy Lutomirski , Joe Perches Cc: Network Development , David Miller , "kernel-hardening@lists.openwall.com" , "Jason A. Donenfeld" , "Theodore Ts'o" , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , Linux Kernel Mailing List Subject: [kernel-hardening] Re: [PATCH v3] scripts: add leaking_addresses.pl X-Virus-Scanned: ClamAV using ClamSMTP On Mon, Nov 6, 2017 at 9:27 AM, Linus Torvalds wrote: > On Sun, Nov 5, 2017 at 9:19 PM, Tobin C. Harding wrote: >> Currently we are leaking addresses from the kernel to user space. This >> script is an attempt to find some of those leakages. Script parses >> `dmesg` output and /proc and /sys files for hex strings that look like >> kernel addresses. > > Lovely. This is great. It shows just how much totally pointless stuff > we leak, and to normal users that really shouldn't need it. > > I had planned to wait for 4.15 to look at the printk hashing stuff > etc, but this part I think I could/should merge early just because I > think a lot of kernel developers will go "Why the f*ck would we expose > that kernel address there?" > > The module sections stuff etc should likely be obviously root-only, > although maybe I'm missing some tool that ends up using it and is > useful to normal developers. > > And I'm thinking we could make kallsyms smarter too, and instead of > depending on kptr_restrict that screws over things with much too big a > hammer, we could make it take 'perf_event_paranoid' into account. I > suspect that's the main user of kallsyms that would still be relevant > to non-root. Linus, what do you have in mind for the root-only "yes we really need the actual address output" exceptions? For example, right now /sys/kernel/debug/kernel_page_tables (CONFIG_X86_PTDUMP=y) needs actual address and currently uses %x. Looking other places that stand out, it seems like /proc/lockdep_chains and /proc/lockdep (CONFIG_LOCKDEP=y) has a ton of %p usage. It's unclear to me if a hash is sufficient for meaningful debugging there? Seems like these three from dmesg could be removed? [ 0.000000] Base memory trampoline at [ffffa3fc40099000] 99000 size 24576 arch/x86/realmode/init.c [ 0.000000] percpu: Embedded 38 pages/cpu @ffffa4007fc00000 s116944 r8192 d30512 u524288 mm/percpu.c [ 0.456395] software IO TLB [mem 0xbbfdf000-0xbffdf000] (64MB) mapped at [ffffa3fcfbfdf000-ffffa3fcfffdefff] lib/swiotlb.c Tobin, some other feedback on v4... I find the output hard to parse. Instead of: [27527 lockdep_chains] [ffffffffb226c628] cgroup_mutex Could we have: 27527 /proc/lockdep_chains: [ffffffffb226c628] cgroup_mutex At the very least, getting the full file path is needed or might not be clear where something lives. And for my kernels, I needed to exclude usbmon or the script would hang (perhaps add a read timeout to the script to detect stalling files?) -Kees diff --git a/scripts/leaking_addresses.pl b/scripts/leaking_addresses.pl index 282c0cc2bdea..a9b729c0a052 100644 --- a/scripts/leaking_addresses.pl +++ b/scripts/leaking_addresses.pl @@ -70,6 +70,7 @@ my @skip_walk_dirs_any = ('self', 'thread-self', 'cwd', 'fd', + 'usbmon', 'stderr', 'stdin', 'stdout');