Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Jul 2018 18:15:58 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Nick Desaulniers <ndesaulniers@...gle.com>
Cc: greg@...ah.com, Kees Cook <keescook@...gle.com>, salyzyn@...roid.com,
 LKML <linux-kernel@...r.kernel.org>, mingo@...hat.com,
 kernel-team@...roid.com, stable@...r.kernel.org,
 kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] tracing: do not leak kernel addresses

On Thu, 26 Jul 2018 09:52:11 -0700
Nick Desaulniers <ndesaulniers@...gle.com> wrote:

> See the section "Kernel addresses" in
> Documentation/security/self-protection.  IIRC, the issue is that a
> process may have CAP_SYSLOG but not necessarily CAP_SYS_ADMIN (so it
> can read dmesg, but not necessarily issue a sysctl to change
> kptr_restrict), get compromised and used to leak kernel addresses,
> which can then be used to defeat KASLR.

But the code doesn't go to dmesg. It's only available
via /sys/kernel/debug/tracing/printk_formats which is only available
via root. Nobody else has access to that directory.

-- Steve

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.