From patchwork Sun Feb 18 07:35:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Guixiong Wei X-Patchwork-Id: 202747 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:693c:2685:b0:108:e6aa:91d0 with SMTP id mn5csp671236dyc; Sat, 17 Feb 2024 23:35:30 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCX4NdknL8Up/MGyBppDVAE0mqQJDhro0iRkui7ZjJHOdujKojpou599KSPbURlaHgTqilSuYqiQe8MNJ5RS0J2uptJ41A== X-Google-Smtp-Source: AGHT+IGnNXdzy8sxYorPXfAHasicGwhKlQxrrPN+lG6q/rdhxSBGxxZx+P+lUmJSnTctD+/s81dQ X-Received: by 2002:a05:622a:254:b0:42d:a679:45fe with SMTP id c20-20020a05622a025400b0042da67945femr11618507qtx.46.1708241730783; Sat, 17 Feb 2024 23:35:30 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1708241730; cv=pass; d=google.com; s=arc-20160816; b=dyfmnEs0oy8qHSKHnUGT4dSYfNe+mCWG7+IuJ6QULA4FQm3Zwe0Vhu9IcgyyhQoiLh t85aC7IOb1mmzxq2+ZbpPJULVmKIFwZbYrqosUPIzGbzArengO+mtc3tcBrKVgOxNP+F qMvn7ZlX5PHD+0kWRycrofvXUuJy/UD+p6BlWLCUCVkKkYuovsOeVn5Ovqrbanngop2s NgFgw+/7xDhpCadqABZs4ywLDkcw2KYY9d/kFk/RgVoyPTQHzNMoqOVUM9nNBUh/77gG L3WYw9CfFqIoLDtK8OQQGnsQFaow3PnWalpOANT+4CkaLtJjQEZpsQ7XvWZjXp8PUIi+ rRig== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from:dkim-signature; bh=FGrS/QrK390LGI0LLUrbrIxCWDxFRathI2WV75UnB8M=; fh=5ThIaKgz2J2NxMlanE0uCq+wQtcpwt6ejniNxKwxOU4=; b=lftjzJtm3H9aGpXGJo5bPPfxKRoi9eUky+vT4r3irt8yiRu3QQ45Ya6jikCqxGJhmc IitP7yDrlImaIWUP6YIxV36rVQ1+2g+J9UqT5Ti7gqFxYqchUBSLVgKjs9dFZ4C20usC ZlD2gBmUCFgdp/KLZiRz7k8TNZoAr/h+eRwDaGvfN5Y3RhuQq+sTloUx1Pf+0WTTVTs6 9Ifbrs6kzopQjHORPc+s8+4znLXpSSNyDBpz6t1Fq58tS9kjftqtH//aLDs4a7GIwAR0 GT5lfqGb4fDNw1x26omCqqvjK85hSPGW+ViCegB9qryDeGK04CPapbKiP5+ddTvLX++i rMlA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MpsSnz2y; arc=pass (i=1 spf=pass spfdomain=gmail.com dkim=pass dkdomain=gmail.com dmarc=pass fromdomain=gmail.com); spf=pass (google.com: domain of linux-kernel+bounces-70251-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-70251-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from ny.mirrors.kernel.org (ny.mirrors.kernel.org. [147.75.199.223]) by mx.google.com with ESMTPS id t16-20020ac87610000000b0042c73ec3866si3430641qtq.530.2024.02.17.23.35.30 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Feb 2024 23:35:30 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-70251-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=MpsSnz2y; arc=pass (i=1 spf=pass spfdomain=gmail.com dkim=pass dkdomain=gmail.com dmarc=pass fromdomain=gmail.com); spf=pass (google.com: domain of linux-kernel+bounces-70251-ouuuleilei=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) smtp.mailfrom="linux-kernel+bounces-70251-ouuuleilei=gmail.com@vger.kernel.org"; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ny.mirrors.kernel.org (Postfix) with ESMTPS id 921791C212E9 for ; Sun, 18 Feb 2024 07:35:30 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 5C745EAD5; Sun, 18 Feb 2024 07:35:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MpsSnz2y" Received: from mail-oo1-f66.google.com (mail-oo1-f66.google.com [209.85.161.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78A17746B for ; Sun, 18 Feb 2024 07:35:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.66 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708241716; cv=none; b=iu4ufSUOQCh6ldQfO+4Uxjfur3uoPN6x5vhIRe8uyQsOTz4fihSTdy0mtD0pJ9/4QXV6YKG/8QrR9fOujvyjqZOZTeE3zF67pv+fhG2LnZndfdtfMkZmqmK43SktWeDwOVdp4MVkHwDr06CrldG5/wZ2ndU7tGKBIXcYRtarLx4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708241716; c=relaxed/simple; bh=+a4H/ahmoRNiU1zYapSk7p0IZYFE8bsHkSV8lIN96Pw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=taPYWh0jP/G16EjpxvLD8JUsuYHB6NT2vv0/nSQ+d+Zii9R2ygFeNHdAOgflLHyHlfMNgS9ixMRjCZFbDYnFj1dS0nopDq9UKQiZsZZafKxwaSXlhpfXo9BaypauNh91sxEBl3zkp6rHr7LxnC9aQ5iQOxYjng9K6/vFLQdaRMU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MpsSnz2y; arc=none smtp.client-ip=209.85.161.66 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-oo1-f66.google.com with SMTP id 006d021491bc7-59f786b2b59so1621984eaf.0 for ; Sat, 17 Feb 2024 23:35:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1708241714; x=1708846514; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FGrS/QrK390LGI0LLUrbrIxCWDxFRathI2WV75UnB8M=; b=MpsSnz2yZWEUv2d3O68AijHRWi1N9GQijOP/QUJglV0p3CgRXLa81z626dw/by3hB5 B7QxqKT/xP00dgCFvOVK46toLwv1ofpUksgiUMUNF8lyWsxLBCwhJZ3g7k0OjHXn7usD 4Hm2ymgGI2FlQRHu5/9fEh4htpibAVYqhZvYBH4C8jMiFrG4OyVIRiqUDBwMaNVMzEvx rseFC7YUN0UZk7d1yTcsE8/xA2sphzXoCCQLuaVrey0c043/98s65OC4Ov2j5ifgkcxC br8ytZSUCJzfKAYHc8kXTAV8IbuK9BWYLKHeaHDwh3pS7o5hQ6LvlZIJoS3x3omX7YU8 knaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708241714; x=1708846514; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=FGrS/QrK390LGI0LLUrbrIxCWDxFRathI2WV75UnB8M=; b=I99SUfzxsz2h4ays3oa1swHDGb6M4GfUCYDZcxfPVMg08gHQB871fMOwz6QBIytF3l pQrmz44UwuO7atggHO02+zWICMs3wb9lBTG/DeuoIvm+prj61hoJgt+KsbsJJLZhnvfA AYYJ1PTWCkjC+wMN3J0UhousWjX1sZ2Obu7Y9dH1EtcYcKbU72aREFRKSHu28Md0IyFN Q3Npau6teSVdqRRPHhFky4IhtXzRFDo/ZQMZLupUvSIpSWi2JDXir14SrHRuAAQ7xRdH S797h6PTpmMIiM0XRjVOzY5czRdHU9aCI8/T5ZLPjoyj96L+WMQ3mw3sSmN+VyxhmVKf Zezg== X-Gm-Message-State: AOJu0YwYqIER8LvdCWHUBR4C/PrJ8GnDIf0iELo1AUW2AZ459zSzNqUp qRfsKTmUP+oUyjQNRqfwsR/dnqUw92t5iXE9BHHTlqV/R3mF47+4 X-Received: by 2002:a05:6358:8427:b0:178:72b5:cf49 with SMTP id b39-20020a056358842700b0017872b5cf49mr10369100rwk.8.1708241714429; Sat, 17 Feb 2024 23:35:14 -0800 (PST) Received: from C02FG0GJMD6V.bytedance.net ([139.177.225.229]) by smtp.gmail.com with ESMTPSA id sk17-20020a17090b2dd100b002997e87b390sm706675pjb.29.2024.02.17.23.35.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Feb 2024 23:35:14 -0800 (PST) From: Guixiong Wei To: gregkh@linuxfoundation.org, jgross@suse.com, boris.ostrovsky@oracle.com Cc: linux-kernel@vger.kernel.org, Guixiong Wei Subject: [RESEND RFC] kernel/ksysfs.c: restrict /sys/kernel/notes to root access Date: Sun, 18 Feb 2024 15:35:01 +0800 Message-Id: <20240218073501.54555-1-guixiongwei@gmail.com> X-Mailer: git-send-email 2.24.3 (Apple Git-128) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1791221281206262098 X-GMAIL-MSGID: 1791221281206262098 From: Guixiong Wei Restrict non-privileged user access to /sys/kernel/notes to avoid security attack. The non-privileged users have read access to notes. The notes expose the load address of startup_xen. This address could be used to bypass KASLR. For example, the startup_xen is built at 0xffffffff82465180 and commit_creds is built at 0xffffffff810ad570 which could read from the /boot/System.map. And the loaded address of startup_xen is 0xffffffffbc265180 which read from /sys/kernel/notes. So the loaded address of commit_creds is 0xffffffffbc265180 - (0xffffffff82465180 - 0xffffffff810ad570) = 0xffffffffbaead570. Signed-off-by: Guixiong Wei Reviewed-by: Kees Cook --- kernel/ksysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/ksysfs.c b/kernel/ksysfs.c index b1292a57c2a5..09bc0730239b 100644 --- a/kernel/ksysfs.c +++ b/kernel/ksysfs.c @@ -199,7 +199,7 @@ static ssize_t notes_read(struct file *filp, struct kobject *kobj, static struct bin_attribute notes_attr __ro_after_init = { .attr = { .name = "notes", - .mode = S_IRUGO, + .mode = S_IRUSR, }, .read = ¬es_read, };