Skip to content

RFC printk: add more new kernel pointer filter options.

Greg KH kernel-hardening lkml 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 RFC Latest6 patches 11 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/6lib: vsprintf: additional kernel pointer filtering optionsDocumentation/printk-formats.txt Documentation/sysctl/kernel.txt kernel/sysctl.c +1 more+63 -292 replies
2/6lib: vsprintf: whitelist stack tracesarch/arm64/kernel/traps.c include/linux/kallsyms.h kernel/printk/printk.c+4 -40 replies
3/6lib: vsprintf: physical address kernel pointer filtering optionsDocumentation/sysctl/kernel.txt kernel/sysctl.c lib/vsprintf.c+38 -61 reply
4/6lib: vsprintf: default kptr_restrict to the maximum valuelib/vsprintf.c+1 -10 replies
5/6lib: vsprintf: Add "%paP", "%padP" optionsDocumentation/printk-formats.txt lib/vsprintf.c+15 -74 replies
6/6drivers: uio: Un-restrict sysfs pointers for UIOdrivers/uio/uio.c+2 -20 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.

Read the v1 thread

Cover letter [RFC 00/06] printk: add more new kernel pointer filter options.

Here's a short patch series from Chris Fries and Dave Weinstein that implement some new restrictions when printing out kernel pointers, as well as the ability to whitelist kernel pointers where needed.

These patches are based on work from William Roberts, and also is inspired by grsecurity's %pP to specifically whitelist a kernel pointer, where it is always needed, like the last patch in the series shows, in the UIO drivers (UIO requires that you know the address, it's a hardware address, nothing wrong with seeing that...)

I haven't done much to this patch series, only forward porting it from an older kernel release (4.4) and a few minor tweaks. It applies cleanly on top of 4.11 as well as Linus's current development tree (10502 patches into the 4.12-rc1 merge window). I'm posting it now for comments if anyone sees anything wrong with this approach, or thinks the things that are being whitelisted should not be?

thanks,

greg k-h

 Documentation/printk-formats.txt |   15 +++-
 Documentation/sysctl/kernel.txt  |   11 +++
 arch/arm64/kernel/traps.c        |    4 -
 drivers/uio/uio.c                |    4 -
 include/linux/kallsyms.h         |    2
 kernel/printk/printk.c           |    2
 kernel/sysctl.c                  |    6 -
 lib/vsprintf.c                   |  128 ++++++++++++++++++++++++++++-----------
 8 files changed, 123 insertions(+), 49 deletions(-)