In order to gain access to the open file's f_cred for kallsym visibility
permission checks, refactor the module section attributes to use the
bin_attribute instead of attribute interface. Additionally removes the
redundant "name" struct member.
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
---
kernel/module.c | 45 ++++++++++++++++++++++++---------------------
1 file changed, 24 insertions(+), 21 deletions(-)
diff --git a/kernel/module.c b/kernel/module.c
index a5022ae84e50..9e2954519259 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1510,8 +1510,7 @@ static inline bool sect_empty(const Elf_Shdr *sect)
}
struct module_sect_attr {
- struct module_attribute mattr;
- char *name;
+ struct bin_attribute battr;
unsigned long address;
};
@@ -1521,11 +1520,16 @@ struct module_sect_attrs {
struct module_sect_attr attrs[];
};
-static ssize_t module_sect_show(struct module_attribute *mattr,
- struct module_kobject *mk, char *buf)
+static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
+ struct bin_attribute *battr,
+ char *buf, loff_t pos, size_t count)
{
struct module_sect_attr *sattr =
- container_of(mattr, struct module_sect_attr, mattr);
+ container_of(battr, struct module_sect_attr, battr);
+
+ if (pos != 0)
+ return -EINVAL;
+
return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
(void *)sattr->address : NULL);
}
@@ -1535,7 +1539,7 @@ static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
unsigned int section;
for (section = 0; section < sect_attrs->nsections; section++)
- kfree(sect_attrs->attrs[section].name);
+ kfree(sect_attrs->attrs[section].battr.attr.name);
kfree(sect_attrs);
}
@@ -1544,42 +1548,41 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info)
unsigned int nloaded = 0, i, size[2];
struct module_sect_attrs *sect_attrs;
struct module_sect_attr *sattr;
- struct attribute **gattr;
+ struct bin_attribute **gattr;
/* Count loaded sections and allocate structures */
for (i = 0; i < info->hdr->e_shnum; i++)
if (!sect_empty(&info->sechdrs[i]))
nloaded++;
size[0] = ALIGN(struct_size(sect_attrs, attrs, nloaded),
- sizeof(sect_attrs->grp.attrs[0]));
- size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.attrs[0]);
+ sizeof(sect_attrs->grp.bin_attrs[0]));
+ size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.bin_attrs[0]);
sect_attrs = kzalloc(size[0] + size[1], GFP_KERNEL);
if (sect_attrs == NULL)
return;
/* Setup section attributes. */
sect_attrs->grp.name = "sections";
- sect_attrs->grp.attrs = (void *)sect_attrs + size[0];
+ sect_attrs->grp.bin_attrs = (void *)sect_attrs + size[0];
sect_attrs->nsections = 0;
sattr = §_attrs->attrs[0];
- gattr = §_attrs->grp.attrs[0];
+ gattr = §_attrs->grp.bin_attrs[0];
for (i = 0; i < info->hdr->e_shnum; i++) {
Elf_Shdr *sec = &info->sechdrs[i];
if (sect_empty(sec))
continue;
+ sysfs_bin_attr_init(&sattr->battr);
sattr->address = sec->sh_addr;
- sattr->name = kstrdup(info->secstrings + sec->sh_name,
- GFP_KERNEL);
- if (sattr->name == NULL)
+ sattr->battr.attr.name =
+ kstrdup(info->secstrings + sec->sh_name, GFP_KERNEL);
+ if (sattr->battr.attr.name == NULL)
goto out;
sect_attrs->nsections++;
- sysfs_attr_init(&sattr->mattr.attr);
- sattr->mattr.show = module_sect_show;
- sattr->mattr.store = NULL;
- sattr->mattr.attr.name = sattr->name;
- sattr->mattr.attr.mode = S_IRUSR;
- *(gattr++) = &(sattr++)->mattr.attr;
+ sattr->battr.read = module_sect_read;
+ sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
+ sattr->battr.attr.mode = 0400;
+ *(gattr++) = &(sattr++)->battr;
}
*gattr = NULL;
@@ -1669,7 +1672,7 @@ static void add_notes_attrs(struct module *mod, const struct load_info *info)
continue;
if (info->sechdrs[i].sh_type == SHT_NOTE) {
sysfs_bin_attr_init(nattr);
- nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
+ nattr->attr.name = mod->sect_attrs->attrs[loaded].battr.attr.name;
nattr->attr.mode = S_IRUGO;
nattr->size = info->sechdrs[i].sh_size;
nattr->private = (void *) info->sechdrs[i].sh_addr;
--
2.25.1
On Thu, Jul 02, 2020 at 04:26:35PM -0700, Kees Cook wrote:
> In order to gain access to the open file's f_cred for kallsym visibility
> permission checks, refactor the module section attributes to use the
> bin_attribute instead of attribute interface. Additionally removes the
> redundant "name" struct member.
>
> Cc: [email protected]
> Signed-off-by: Kees Cook <[email protected]>
> ---
> kernel/module.c | 45 ++++++++++++++++++++++++---------------------
> 1 file changed, 24 insertions(+), 21 deletions(-)
>
> diff --git a/kernel/module.c b/kernel/module.c
> index a5022ae84e50..9e2954519259 100644
> --- a/kernel/module.c
> +++ b/kernel/module.c
> @@ -1510,8 +1510,7 @@ static inline bool sect_empty(const Elf_Shdr *sect)
> }
>
> struct module_sect_attr {
> - struct module_attribute mattr;
> - char *name;
> + struct bin_attribute battr;
> unsigned long address;
> };
>
> @@ -1521,11 +1520,16 @@ struct module_sect_attrs {
> struct module_sect_attr attrs[];
> };
>
> -static ssize_t module_sect_show(struct module_attribute *mattr,
> - struct module_kobject *mk, char *buf)
> +static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
> + struct bin_attribute *battr,
> + char *buf, loff_t pos, size_t count)
> {
> struct module_sect_attr *sattr =
> - container_of(mattr, struct module_sect_attr, mattr);
> + container_of(battr, struct module_sect_attr, battr);
> +
> + if (pos != 0)
> + return -EINVAL;
> +
> return sprintf(buf, "0x%px\n", kptr_restrict < 2 ?
> (void *)sattr->address : NULL);
> }
> @@ -1535,7 +1539,7 @@ static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
> unsigned int section;
>
> for (section = 0; section < sect_attrs->nsections; section++)
> - kfree(sect_attrs->attrs[section].name);
> + kfree(sect_attrs->attrs[section].battr.attr.name);
> kfree(sect_attrs);
> }
>
> @@ -1544,42 +1548,41 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info)
> unsigned int nloaded = 0, i, size[2];
> struct module_sect_attrs *sect_attrs;
> struct module_sect_attr *sattr;
> - struct attribute **gattr;
> + struct bin_attribute **gattr;
>
> /* Count loaded sections and allocate structures */
> for (i = 0; i < info->hdr->e_shnum; i++)
> if (!sect_empty(&info->sechdrs[i]))
> nloaded++;
> size[0] = ALIGN(struct_size(sect_attrs, attrs, nloaded),
> - sizeof(sect_attrs->grp.attrs[0]));
> - size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.attrs[0]);
> + sizeof(sect_attrs->grp.bin_attrs[0]));
> + size[1] = (nloaded + 1) * sizeof(sect_attrs->grp.bin_attrs[0]);
> sect_attrs = kzalloc(size[0] + size[1], GFP_KERNEL);
> if (sect_attrs == NULL)
> return;
>
> /* Setup section attributes. */
> sect_attrs->grp.name = "sections";
> - sect_attrs->grp.attrs = (void *)sect_attrs + size[0];
> + sect_attrs->grp.bin_attrs = (void *)sect_attrs + size[0];
>
> sect_attrs->nsections = 0;
> sattr = §_attrs->attrs[0];
> - gattr = §_attrs->grp.attrs[0];
> + gattr = §_attrs->grp.bin_attrs[0];
> for (i = 0; i < info->hdr->e_shnum; i++) {
> Elf_Shdr *sec = &info->sechdrs[i];
> if (sect_empty(sec))
> continue;
> + sysfs_bin_attr_init(&sattr->battr);
> sattr->address = sec->sh_addr;
> - sattr->name = kstrdup(info->secstrings + sec->sh_name,
> - GFP_KERNEL);
> - if (sattr->name == NULL)
> + sattr->battr.attr.name =
> + kstrdup(info->secstrings + sec->sh_name, GFP_KERNEL);
> + if (sattr->battr.attr.name == NULL)
> goto out;
> sect_attrs->nsections++;
> - sysfs_attr_init(&sattr->mattr.attr);
> - sattr->mattr.show = module_sect_show;
> - sattr->mattr.store = NULL;
> - sattr->mattr.attr.name = sattr->name;
> - sattr->mattr.attr.mode = S_IRUSR;
> - *(gattr++) = &(sattr++)->mattr.attr;
> + sattr->battr.read = module_sect_read;
> + sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
> + sattr->battr.attr.mode = 0400;
> + *(gattr++) = &(sattr++)->battr;
> }
> *gattr = NULL;
>
> @@ -1669,7 +1672,7 @@ static void add_notes_attrs(struct module *mod, const struct load_info *info)
> continue;
> if (info->sechdrs[i].sh_type == SHT_NOTE) {
> sysfs_bin_attr_init(nattr);
> - nattr->attr.name = mod->sect_attrs->attrs[loaded].name;
> + nattr->attr.name = mod->sect_attrs->attrs[loaded].battr.attr.name;
> nattr->attr.mode = S_IRUGO;
> nattr->size = info->sechdrs[i].sh_size;
> nattr->private = (void *) info->sechdrs[i].sh_addr;
> --
> 2.25.1
>
They get a correct "size" value now, nice!
Reviewed-by: Greg Kroah-Hartman <[email protected]>
On Fri, Jul 03, 2020 at 08:02:07AM +0200, Greg Kroah-Hartman wrote:
> On Thu, Jul 02, 2020 at 04:26:35PM -0700, Kees Cook wrote:
> > + sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
>
> They get a correct "size" value now, nice!
Yeah, though I do have some concerns that switching to a bin attribute
changes the userspace behavior a bit. With seq_file-based "show", we
get a 4096 size, and seeking isn't possible (lseek to non-0 location
will fail). With the raw "read", we get the right size, but lseek()
is allowed (but I've got the "read" handler refuse reads starting from
non-zero). When I reviewed[1] potential readers (elftutils, systemtap,
kmod), they all seem to do normal things (fopen/fscanf/fclose), so I'm
hoping this won't be a problem in practice.
> Reviewed-by: Greg Kroah-Hartman <[email protected]>
Thanks!
[1] https://codesearch.debian.net/search?q=%2Fsys%2Fmodule.*sections&literal=0
--
Kees Cook
+++ Kees Cook [02/07/20 16:26 -0700]:
>In order to gain access to the open file's f_cred for kallsym visibility
>permission checks, refactor the module section attributes to use the
>bin_attribute instead of attribute interface. Additionally removes the
>redundant "name" struct member.
>
>Cc: [email protected]
>Signed-off-by: Kees Cook <[email protected]>
Hi Kees,
This looks good to me:
Tested-by: Jessica Yu <[email protected]>
Acked-by: Jessica Yu <[email protected]>
Thanks!