Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-10 Thread Masami Hiramatsu
On Thu, 2 Jul 2020 16:26:37 -0700 Kees Cook wrote: > The kprobe show() functions were using "current"'s creds instead > of the file opener's creds for kallsyms visibility. Fix to use > seq_file->file->f_cred. This looks good to me. Acked-by: Masami Hiramatsu Thanks! > > Cc: sta...@vger.ker

Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-05 Thread Kees Cook
On Sun, Jul 05, 2020 at 01:10:54PM -0700, Linus Torvalds wrote: > On Fri, Jul 3, 2020 at 8:50 AM Kees Cook wrote: > > > > With 67 kthreads on a booted system, this patch does not immediately > > blow up... > > Did you try making read/write inc/dec that thing too? Or does that > just blow up with

Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-05 Thread Linus Torvalds
On Fri, Jul 3, 2020 at 8:50 AM Kees Cook wrote: > > With 67 kthreads on a booted system, this patch does not immediately > blow up... Did you try making read/write inc/dec that thing too? Or does that just blow up with tons of warnings? Linus

Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-03 Thread Kees Cook
On Thu, Jul 02, 2020 at 06:00:17PM -0700, Linus Torvalds wrote: > If somebody is interested in looking into things like that, it might > be a good idea to have kernel threads with that counter incremented by > default. With 67 kthreads on a booted system, this patch does not immediately blow up...

Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-03 Thread Kees Cook
On Thu, Jul 02, 2020 at 06:00:17PM -0700, Linus Torvalds wrote: > On Thu, Jul 2, 2020 at 4:26 PM Kees Cook wrote: > > > > The kprobe show() functions were using "current"'s creds instead > > of the file opener's creds for kallsyms visibility. Fix to use > > seq_file->file->f_cred. > > Side note:

Re: [PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-02 Thread Linus Torvalds
On Thu, Jul 2, 2020 at 4:26 PM Kees Cook wrote: > > The kprobe show() functions were using "current"'s creds instead > of the file opener's creds for kallsyms visibility. Fix to use > seq_file->file->f_cred. Side note: I have a distinct - but despite that possibly quite incorrect - memory that I'

[PATCH 4/5] kprobes: Do not expose probe addresses to non-CAP_SYSLOG

2020-07-02 Thread Kees Cook
The kprobe show() functions were using "current"'s creds instead of the file opener's creds for kallsyms visibility. Fix to use seq_file->file->f_cred. Cc: sta...@vger.kernel.org Fixes: 81365a947de4 ("kprobes: Show address of kprobes if kallsyms does") Fixes: ffb9bd68ebdb ("kprobes: Show blacklist