[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Jul 2018 18:15:58 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Nick Desaulniers <ndesaulniers@...gle.com>
Cc: greg@...ah.com, Kees Cook <keescook@...gle.com>, salyzyn@...roid.com,
LKML <linux-kernel@...r.kernel.org>, mingo@...hat.com,
kernel-team@...roid.com, stable@...r.kernel.org,
kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] tracing: do not leak kernel addresses
On Thu, 26 Jul 2018 09:52:11 -0700
Nick Desaulniers <ndesaulniers@...gle.com> wrote:
> See the section "Kernel addresses" in
> Documentation/security/self-protection. IIRC, the issue is that a
> process may have CAP_SYSLOG but not necessarily CAP_SYS_ADMIN (so it
> can read dmesg, but not necessarily issue a sysctl to change
> kptr_restrict), get compromised and used to leak kernel addresses,
> which can then be used to defeat KASLR.
But the code doesn't go to dmesg. It's only available
via /sys/kernel/debug/tracing/printk_formats which is only available
via root. Nobody else has access to that directory.
-- Steve
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
