Skip to contentSkip to conversation

Kprobes as a module?

QUESTION Namhyung Kim 4 participants 7 messages May 15, 2012 – May 16, 2012

lore
Share & tools
lore

Namhyung Kim

author
#0 lore raw

Hi,

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Thanks,
Namhyung

#1 lore raw
Quoted 8 lines · Namhyung Kim

Hi,

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Kconfig prevents that:

config KPROBES
bool "Kprobes"
depends on MODULES
depends on HAVE_KPROBES
select KALLSYMS

so you can have either CONFIG_KPROBES=y or CONFIG_KPROBES=n, but not =m.

author
#2 lore raw

Hi,

Quoted 12 lines · Cong Wang
Quoted 8 lines · Namhyung Kim

Hi,

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Kconfig prevents that:

Quoted 8 lines

config KPROBES
bool "Kprobes"
depends on MODULES
depends on HAVE_KPROBES
select KALLSYMS

so you can have either CONFIG_KPROBES=y or CONFIG_KPROBES=n, but not =m.

Sorry for an inaccurate question, my point was "Can I change it from 'bool' to 'tristate'"?

Thanks,
Namhyung

#3 lore raw

Hi,

No, actually you can't make it as a module.　There are two major reasons.
- ftrace depends on the kprobes now.
- int3 handling routine is deeply depends on the architecture. This includes text modifying code.

Thus, if you separate the kprobes into module, that means you need to expose more ugly interface of self modifying for kernel modules.

Quoted 11 lines · Namhyung Kim

Hi,

Quoted 8 lines · Cong Wang
Quoted 7 lines · Namhyung Kim

Hi,

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

BTW, I'm not sure what the potential security problems on that? kprobes itself can be used only from kernel modules(except ftrace). If someone compromises kernel with kernel module, he doesn't need kprobes at all. They just can do anything they want. :)

Thank you,

Signature · 4 lines
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: [email protected]
author
#4 lore raw

Hi,

Quoted 10 lines · Masami Hiramatsu

No, actually you can't make it as a module.　There are two major reasons.
- ftrace depends on the kprobes now.
- int3 handling routine is deeply depends on the architecture. This includes text modifying code.

Thus, if you separate the kprobes into module, that means you need to expose more ugly interface of self modifying for kernel modules.

I see.

Quoted 13 lines
Quoted 11 lines · Namhyung Kim

Hi,

Quoted 8 lines · Cong Wang
Quoted 7 lines · Namhyung Kim

Hi,

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Quoted 5 lines

BTW, I'm not sure what the potential security problems on that? kprobes itself can be used only from kernel modules(except ftrace). If someone compromises kernel with kernel module, he doesn't need kprobes at all. They just can do anything they want. :)

Nevermind, it seems they just worried about what they don't know exactly. Anyway, thanks for your answer.

Namhyung

#5 lore raw
In reply to Namhyung Kim
Quoted 5 lines · Namhyung Kim

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Any troublemaker who has the ability to set a kprobe would probably also have theability to just re-load the module before setting the kprobe (unless you go to a *lot* of trouble to compartmentalize the root user).

So it's not clear there's a security benefit from making it a module. If anything, it makes it *worse* because you can then surprise a sysadmin who *thought* they were running a KPROBES=n kernel by loading a module and turning it on...

author
#6 lore raw

Hi,

Quoted 7 lines · valdis kletnieks
Quoted 5 lines · Namhyung Kim

Probably a dumb question :).
What prevents the kprobes from being built as a module? We want to use the kprobes on our systems, but some guys worried about potential security problems. So it'd be great if we can enable/load kprobes as needed and then disable/unload after using it. Is it a possible senario?

Quoted 7 lines

Any troublemaker who has the ability to set a kprobe would probably also have theability to just re-load the module before setting the kprobe (unless you go to a *lot* of trouble to compartmentalize the root user).

So it's not clear there's a security benefit from making it a module. If anything, it makes it *worse* because you can then surprise a sysadmin who *thought* they were running a KPROBES=n kernel by loading a module and turning it on...

Right, thanks for your comment.

Namhyung