Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752619AbdCNTwt (ORCPT ); Tue, 14 Mar 2017 15:52:49 -0400 Received: from mail-wr0-f195.google.com ([209.85.128.195]:33315 "EHLO mail-wr0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750815AbdCNTwr (ORCPT ); Tue, 14 Mar 2017 15:52:47 -0400 Date: Tue, 14 Mar 2017 21:52:40 +0200 From: Krzysztof Kozlowski To: Tobias Jakobi Cc: Inki Dae , Joonyoung Shim , Seung-Woo Kim , Kyungmin Park , David Airlie , Kukjin Kim , Javier Martinez Canillas , dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] drm/exynos: Print kernel pointers in a restricted form Message-ID: <20170314195240.gj7jbgql7hfziw42@kozik-lap> References: <20170314183804.13788-1-krzk@kernel.org> <20170314190859.y55wlc4z7xdsbbxg@kozik-lap> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.2-neo (2016-08-21) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1415 Lines: 35 On Tue, Mar 14, 2017 at 08:17:35PM +0100, Tobias Jakobi wrote: > Krzysztof Kozlowski wrote: > > On Tue, Mar 14, 2017 at 08:01:41PM +0100, Tobias Jakobi wrote: > >> Hello Krzysztof, > >> > >> I was wondering about the benefit of this. From a quick look these are > >> all messages that end up in the kernel log / dmesg. > >> > >> IIRC %pK does nothing there, since dmest_restrict is supposed to be used > >> to deny an unpriviliged user the access to the kernel log. > >> > >> Or am I missing something here? > > > > These are regular printks so depending on kernel options (e.g. dynamic > > debug, drm.debug) these might be printed also in the console. Of course > > we could argue then if access to one of the consoles is worth > > securing. > This here suggests otherwise. > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/sysctl/kernel.txt#n388 > > I have not tested this, but IIRC %pK is not honored by the kernel > logging infrastucture. That's why dmesg_restrict is there. > > Correct me if I'm wrong. The %pK will not help for dmesg or /proc/kmsg but it will help for console (/dev/ttySACN, ttySN etc) because effectively it uses the same vsprintf()/pointer() functions. As I said, we could argue whether securing console is worth... usually attacker having access to it has also physical access to the machine so everything gets easier... Best regards, Krzysztof