Commit 455cd5ab authored by Dan Rosenberg's avatar Dan Rosenberg Committed by Linus Torvalds
Browse files

kptr_restrict for hiding kernel pointers from unprivileged users 



Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict
sysctl.

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

[akpm@linux-foundation.org: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/]
[akpm@linux-foundation.org: coding-style fixup]
[randy.dunlap@oracle.com: fix kernel/sysctl.c warning]
Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: default avatarRandy Dunlap <randy.dunlap@oracle.com>
Cc: James Morris <jmorris@namei.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Thomas Graf <tgraf@infradead.org>
Cc: Eugene Teo <eugeneteo@kernel.org>
Cc: Kees Cook <kees.cook@canonical.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: David S. Miller <davem@davemloft.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Eric Paris <eparis@parisplace.org>

Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 351f8f8e

Documentation/sysctl/kernel.txt

+14 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ show up in /proc/sys/kernel: 
- hotplug

- java-appletviewer           [ binfmt_java, obsolete ]

- java-interpreter            [ binfmt_java, obsolete ]

- kptr_restrict

- kstack_depth_to_print       [ X86 only ]

- l2cr                        [ PPC only ]

- modprobe                    ==> Documentation/debugging-modules.txt
@@ -261,6 +262,19 @@ This flag controls the L2 cache of G3 processor boards. If 


==============================================================



kptr_restrict:



This toggle indicates whether restrictions are placed on

exposing kernel addresses via /proc and other interfaces.  When

kptr_restrict is set to (0), there are no restrictions.  When

kptr_restrict is set to (1), the default, kernel pointers

printed using the %pK format specifier will be replaced with 0's

unless the user has CAP_SYSLOG.  When kptr_restrict is set to

(2), kernel pointers printed using %pK will be replaced with 0's

regardless of privileges.



==============================================================



kstack_depth_to_print: (X86 only)



Controls the number of words to print when dumping the raw

include/linux/printk.h

+1 −0
Original line number Diff line number Diff line
@@ -83,6 +83,7 @@ extern bool printk_timed_ratelimit(unsigned long *caller_jiffies, 


extern int printk_delay_msec;

extern int dmesg_restrict;

extern int kptr_restrict;



/*

 * Print a one-time message (analogous to WARN_ONCE() et al):

kernel/sysctl.c

+10 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ 
#include <linux/slab.h>

#include <linux/sysctl.h>

#include <linux/signal.h>

#include <linux/printk.h>

#include <linux/proc_fs.h>

#include <linux/security.h>

#include <linux/ctype.h>
@@ -710,6 +711,15 @@ static struct ctl_table kern_table[] = { 
		.extra1		= &zero,

		.extra2		= &one,

	},

	{

		.procname	= "kptr_restrict",

		.data		= &kptr_restrict,

		.maxlen		= sizeof(int),

		.mode		= 0644,

		.proc_handler	= proc_dointvec_minmax,

		.extra1		= &zero,

		.extra2		= &two,

	},

#endif

	{

		.procname	= "ngroups_max",

lib/vsprintf.c

+22 −0
Original line number Diff line number Diff line
@@ -936,6 +936,8 @@ char *uuid_string(char *buf, char *end, const u8 *addr, 
	return string(buf, end, uuid, spec);

}



int kptr_restrict = 1;



/*

 * Show a '%p' thing.  A kernel extension is that the '%p' is followed

 * by an extra set of alphanumeric characters that are extended format
@@ -979,6 +981,7 @@ char *uuid_string(char *buf, char *end, const u8 *addr, 
 *       Implements a "recursive vsnprintf".

 *       Do not use this feature without some mechanism to verify the

 *       correctness of the format string and va_list arguments.

 * - 'K' For a kernel pointer that should be hidden from unprivileged users

 *

 * Note: The difference between 'S' and 'F' is that on ia64 and ppc64

 * function pointers are really function descriptors, which contain a
@@ -1035,6 +1038,25 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr, 
		return buf + vsnprintf(buf, end - buf,

				       ((struct va_format *)ptr)->fmt,

				       *(((struct va_format *)ptr)->va));

	case 'K':

		/*

		 * %pK cannot be used in IRQ context because its test

		 * for CAP_SYSLOG would be meaningless.

		 */

		if (in_irq() || in_serving_softirq() || in_nmi()) {

			if (spec.field_width == -1)

				spec.field_width = 2 * sizeof(void *);

			return string(buf, end, "pK-error", spec);

		} else if ((kptr_restrict == 0) ||

			 (kptr_restrict == 1 &&

			  has_capability_noaudit(current, CAP_SYSLOG)))

			break;



		if (spec.field_width == -1) {

			spec.field_width = 2 * sizeof(void *);

			spec.flags |= ZEROPAD;

		}

		return number(buf, end, 0, spec);

	}

	spec.flags |= SMALL;

	if (spec.field_width == -1) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE