]> git.baikalelectronics.ru Git - kernel.git/commit
module: Do not expose section addresses to non-CAP_SYSLOG
authorKees Cook <keescook@chromium.org>
Thu, 2 Jul 2020 21:43:59 +0000 (14:43 -0700)
committerKees Cook <keescook@chromium.org>
Wed, 8 Jul 2020 23:00:19 +0000 (16:00 -0700)
commit1962a50a3327429f16cc20829c8f9b054b2b011a
tree7b08c4c227a9299a22e0b006a74b11a4729c32cd
parent78e6aec749896d04b62b1fa3a57745ede8aca032
module: Do not expose section addresses to non-CAP_SYSLOG

The printing of section addresses in /sys/module/*/sections/* was not
using the correct credentials to evaluate visibility.

Before:

 # cat /sys/module/*/sections/.*text
 0xffffffffc0458000
 ...
 # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
 0xffffffffc0458000
 ...

After:

 # cat /sys/module/*/sections/*.text
 0xffffffffc0458000
 ...
 # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
 0x0000000000000000
 ...

Additionally replaces the existing (safe) /proc/modules check with
file->f_cred for consistency.

Reported-by: Dominik Czarnota <dominik.czarnota@trailofbits.com>
Fixes: 9687088230db ("module: Fix display of wrong module .text address")
Cc: stable@vger.kernel.org
Tested-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
kernel/module.c