kprobes: Do not expose probe addresses to non-CAP_SYSLOG (60f7bb66) · Commits · 戴 / test

The kprobe show() functions were using "current"'s creds instead of the file opener's creds for kallsyms visibility. Fix to use seq_file->file->f_cred. Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: stable@vger.kernel.org Fixes: ("kprobes: Show address of kprobes if kallsyms does") Fixes: ("kprobes: Show blacklist addresses as same as kallsyms does") Signed-off-by:

Kees Cook <keescook@chromium.org>

kernel/kprobes.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2448,7 +2448,7 @@ static void report_probe(struct seq_file pi, struct kprobe p,
		else
		kprobe_type = "k";

		if (!kallsyms_show_value(current_cred()))
		if (!kallsyms_show_value(pi->file->f_cred))
		addr = NULL;

		if (sym)
		@@ -2540,7 +2540,7 @@ static int kprobe_blacklist_seq_show(struct seq_file m, void v)
		* If /proc/kallsyms is not showing kernel address, we won't
		* show them here either.
		*/
		if (!kallsyms_show_value(current_cred()))
		if (!kallsyms_show_value(m->file->f_cred))
		seq_printf(m, "0x%px-0x%px\t%ps\n", NULL, NULL,
		(void *)ent->start_addr);
		else

Admin message