Dan Rosenberg 455cd5ab30 kptr_restrict for hiding kernel pointers from unprivileged users
Add the %pK printk format specifier and the /proc/sys/kernel/kptr_restrict
sysctl.

The %pK format specifier is designed to hide exposed kernel pointers,
specifically via /proc interfaces.  Exposing these pointers provides an
easy target for kernel write vulnerabilities, since they reveal the
locations of writable structures containing easily triggerable function
pointers.  The behavior of %pK depends on the kptr_restrict sysctl.

If kptr_restrict is set to 0, no deviation from the standard %p behavior
occurs.  If kptr_restrict is set to 1, the default, if the current user
(intended to be a reader via seq_printf(), etc.) does not have CAP_SYSLOG
(currently in the LSM tree), kernel pointers using %pK are printed as 0's.
 If kptr_restrict is set to 2, kernel pointers using %pK are printed as
0's regardless of privileges.  Replacing with 0's was chosen over the
default "(null)", which cannot be parsed by userland %p, which expects
"(nil)".

[akpm@linux-foundation.org: check for IRQ context when !kptr_restrict, save an indent level, s/WARN/WARN_ONCE/]
[akpm@linux-foundation.org: coding-style fixup]
[randy.dunlap@oracle.com: fix kernel/sysctl.c warning]
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Cc: James Morris <jmorris@namei.org>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Thomas Graf <tgraf@infradead.org>
Cc: Eugene Teo <eugeneteo@kernel.org>
Cc: Kees Cook <kees.cook@canonical.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: David S. Miller <davem@davemloft.net>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Eric Paris <eparis@parisplace.org>

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-01-13 08:03:08 -08:00
..
2008-07-24 10:47:33 -07:00
2010-10-26 16:52:18 -07:00
2008-06-06 11:29:10 -07:00
2009-11-03 16:06:53 +01:00
2010-07-11 22:16:32 +02:00
2009-01-01 10:12:19 +10:30
2009-06-18 13:04:05 -07:00
2010-05-25 08:07:06 -07:00
2010-04-06 15:52:11 -07:00
2008-07-26 12:00:07 -07:00
2010-08-09 20:45:05 -07:00
2009-12-14 23:55:33 +01:00
2010-11-22 13:25:13 +10:00
2009-10-01 21:17:49 +02:00
2010-10-26 16:52:19 -07:00
2010-11-12 07:55:32 -08:00
2010-06-16 18:08:13 +02:00
2010-01-11 09:34:05 -08:00
2010-03-06 11:26:35 -08:00
2008-07-26 12:00:10 -07:00
2010-05-19 22:40:47 -04:00