diff options
| author | Kees Cook <keescook@chromium.org> | 2020-07-02 14:43:59 -0700 |
|---|---|---|
| committer | Kees Cook <keescook@chromium.org> | 2020-07-08 16:00:19 -0700 |
| commit | b25a7c5af9051850d4f3d93ca500056ab6ec724b (patch) | |
| tree | 7b08c4c227a9299a22e0b006a74b11a4729c32cd /kernel/kprobes.c | |
| parent | ed66f991bb19d94cae5d38f77de81f96aac7813f (diff) | |
| download | linux-stable-b25a7c5af9051850d4f3d93ca500056ab6ec724b.tar.gz linux-stable-b25a7c5af9051850d4f3d93ca500056ab6ec724b.tar.bz2 linux-stable-b25a7c5af9051850d4f3d93ca500056ab6ec724b.zip | |
module: Do not expose section addresses to non-CAP_SYSLOG
The printing of section addresses in /sys/module/*/sections/* was not
using the correct credentials to evaluate visibility.
Before:
# cat /sys/module/*/sections/.*text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0xffffffffc0458000
...
After:
# cat /sys/module/*/sections/*.text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0x0000000000000000
...
Additionally replaces the existing (safe) /proc/modules check with
file->f_cred for consistency.
Reported-by: Dominik Czarnota <dominik.czarnota@trailofbits.com>
Fixes: be71eda5383f ("module: Fix display of wrong module .text address")
Cc: stable@vger.kernel.org
Tested-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Diffstat (limited to 'kernel/kprobes.c')
0 files changed, 0 insertions, 0 deletions