Received: by 2002:a05:7412:798b:b0:fc:a2b0:25d7 with SMTP id fb11csp411043rdb; Thu, 22 Feb 2024 07:31:47 -0800 (PST) X-Forwarded-Encrypted: i=3; AJvYcCWlL4gcJ1EKEGd+pjKoEsQjLMDog3Rnom5QladfzHWNaPAwSubnQCsE4ENnMpUyIYXTyGxZ0/k9tlC96Nq2pBQj3oibTbD1cEJEjeBzrw== X-Google-Smtp-Source: AGHT+IG+I+inq9F+RXkvpC1B8I1Yrh5a20dWl283DFHSFrv8katdOs2Crm4u95Qp613jL6njVm4Q X-Received: by 2002:a17:902:cec2:b0:1d8:ab27:d76c with SMTP id d2-20020a170902cec200b001d8ab27d76cmr25572084plg.51.1708615907659; Thu, 22 Feb 2024 07:31:47 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1708615907; cv=pass; d=google.com; s=arc-20160816; b=bGqDY4HdX6M3SrMoZQDVN8S3Nsy61DWXHXP97CXxOaJL+Tr5CmCFkjQzpWtZlZja+K nIS20euiysTk0CMv9NTVuEbqxe7AtZmJ1LPU238aEdpbfXNKh0AP5PRZ7tIQDZZhmqZY six4XzVT81wyNGJ3R6kkWRK5DMYz0PpGSlwiTCuHkvslfoLSL/LST7Qx9ao+sqm6wM1X xvpVpnMgwg6BT/dhQJqNzr4TaQFsRyVqn0k7NpEnrY5C1iyOGF9oKYDjnIE8p6nr7Fsh rl0oo8eDWDZBNxLr6iS8v1ZqtDegqbt6wr2nu2vDZXfHPxvsUtuLxuIfoOnTRuEJDlWK /6Qg== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=in-reply-to:content-disposition:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:message-id:subject:cc :to:from:date:feedback-id:dkim-signature:dkim-signature; bh=ak/xySA9kPx5TQpgiD9qkPOWCJZDiY1FRY7rnoAd+nI=; fh=0aoC5z3jhPVpxLZEZUtXriQUvITXUQGn5kA5DDoVkzU=; b=PW8Q1qkFtyQ2QFOUoHfW8YnR7p3vhf7Iv/h2pdslrgJYI4qGKIkJjc9e6g20qiBSH4 O3v+kN7MuqVnOOwnwicJC+8IZnJuhmcV5tdyY1KPGRdF1wzWpo1q/H4r5UkZhFeBPE4A d8cpjWvTcsAYs0xTOsdot803ksOZj3E/SEdrgMlfSbF++QjQWdU8m3puWmNt1lcS98Vg 3ClVGdAkfHSGLOj6U7jN7mS7AFu0PuTPz7mFMPIivlrrCwwn1Ncm53KLl/AfBvG9kQ4F XPBN3Ax3928BvsYxs7uwbSxkQERJidaVeWTnthQwwoNwKVAM+oYHT/8rgfwK4Axv6c87 zruQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@tycho.pizza header.s=fm3 header.b=MjHSoh1g; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=GG1wN9W1; arc=pass (i=1 spf=pass spfdomain=tycho.pizza dkim=pass dkdomain=tycho.pizza dkim=pass dkdomain=messagingengine.com); spf=pass (google.com: domain of linux-kernel+bounces-76769-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-76769-linux.lists.archive=gmail.com@vger.kernel.org" Return-Path: Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id x15-20020a170902ec8f00b001d95a6b0b54si10757789plg.252.2024.02.22.07.31.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 22 Feb 2024 07:31:47 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-76769-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@tycho.pizza header.s=fm3 header.b=MjHSoh1g; dkim=pass header.i=@messagingengine.com header.s=fm1 header.b=GG1wN9W1; arc=pass (i=1 spf=pass spfdomain=tycho.pizza dkim=pass dkdomain=tycho.pizza dkim=pass dkdomain=messagingengine.com); spf=pass (google.com: domain of linux-kernel+bounces-76769-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-76769-linux.lists.archive=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 89FFD28B0D6 for ; Thu, 22 Feb 2024 15:24:15 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 628E71353E2; Thu, 22 Feb 2024 15:24:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=tycho.pizza header.i=@tycho.pizza header.b="MjHSoh1g"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="GG1wN9W1" Received: from fhigh5-smtp.messagingengine.com (fhigh5-smtp.messagingengine.com [103.168.172.156]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C91321474AC; Thu, 22 Feb 2024 15:24:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=103.168.172.156 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708615449; cv=none; b=eD+5GtYcBzQGq4MJ1IB/4MtcjbuU91WpmLQuZOvaMcC1N1/ZB2Ngqwb+UYrlCYAO2flK1c0vAAmt99N7LXIV7xjJgYiEeaBVqGoPCwzYqejah+ZCcq5pMauKrx6I3ULXuk5mx6GCnEj8Qdja2ZdIP9u/UbpDphOcjjtVJeXYW7k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1708615449; c=relaxed/simple; bh=q4hZCcz/bl8SZjjfDLe/pnUi5JMqdAmCHiBzeXrZpyU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=izPYcursNj0jd5dPo3xjN7o94yeHIIvlz3mfqTXN79bqHcLnX2p7qGJmmA+MITby4RA/kPXh5lmhFF864XfokyFKr5V1ZmtkVHfRTeqy0pSK6iBYbMYovruESdf9/c7cGGhtRCAN3G4BthqA2hJWkWZa8/OooBNuV+8hjaZh1cc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tycho.pizza; spf=pass smtp.mailfrom=tycho.pizza; dkim=pass (2048-bit key) header.d=tycho.pizza header.i=@tycho.pizza header.b=MjHSoh1g; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=GG1wN9W1; arc=none smtp.client-ip=103.168.172.156 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=tycho.pizza Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=tycho.pizza Received: from compute7.internal (compute7.nyi.internal [10.202.2.48]) by mailfhigh.nyi.internal (Postfix) with ESMTP id B1F4411400BE; Thu, 22 Feb 2024 10:24:05 -0500 (EST) Received: from mailfrontend2 ([10.202.2.163]) by compute7.internal (MEProxy); Thu, 22 Feb 2024 10:24:05 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tycho.pizza; h= cc:cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1708615445; x=1708701845; bh=ak/xySA9kP x5TQpgiD9qkPOWCJZDiY1FRY7rnoAd+nI=; b=MjHSoh1gTLkHrYXp2mwqvo7RnM 24Et6oTsgnBDvxFOMfEFX4DWynykTjy/aoNkMm/hixoenPCUwQM/YTACnCBPQwJT GU+vx5gRW4krEuz5xn1AO+KCNksDeOsKdIiJTSOunwEiD9c4PrLlgmCpMWGBvhN0 VDexuHspgxH8lVHNnox1o3ijpDUb+CgF0Kl+JPtY2iS7S0d56yixdGtJhDCh+bEa e8jYqBknoCd5CrAJKdLjipptN5HOV1i5g6iLTkS0Z8dtpjZMR6EeBZIOypwduAVa AqSk7RSy7sPCSh5TE6975v4Y2eY29YzOPkCJCOCkWBsFacj6gQinMet01aRQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm1; t=1708615445; x=1708701845; bh=ak/xySA9kPx5TQpgiD9qkPOWCJZD iY1FRY7rnoAd+nI=; b=GG1wN9W1KVdtYsG8N1Q/jA8GEpqPy2w65ZDmRnxsMlgs ZiigHLzqDxGbkJOwC7YfaoyBbbOs/7aDFF7+Qba1qX0wQ4pO0n+guV7nbdPgf+76 KCgef/7GUBGs88Zyay2Oz01A11iWz3L1RPmPxtFPyF06dhM4+C8bf1BBicU5xsDA d30QeEb9LBvaryH7jCRjPO8fbw9NKawtrDDnzh1b62ijhaJ48xZnpIS5PyNgn9Ym DxtnIB0+c65//mogLNG41sgF0fs5ECvfKbdfgYrG5u/7vmxvl2YheLI+yjCDE3Xg mnYyofmawWhMPuqfBN6rUfKA/rjfZnp2+/NDa1pcHg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvledrfeeggdejgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpeffhffvvefukfhfgggtuggjsehttdortddttddvnecuhfhrohhmpefvhigthhho ucetnhguvghrshgvnhcuoehthigthhhosehthigthhhordhpihiiiigrqeenucggtffrrg htthgvrhhnpeelffekveduvefftdejkefhtefhgeduhffghfejtdehieevjedtkeejveej keeuieenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpe hthigthhhosehthigthhhordhpihiiiigr X-ME-Proxy: Feedback-ID: i21f147d5:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 22 Feb 2024 10:24:04 -0500 (EST) Date: Thu, 22 Feb 2024 08:24:02 -0700 From: Tycho Andersen To: Kees Cook Cc: "Tobin C. Harding" , Greg KH , Guixiong Wei , linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] leaking_addresses: Provide mechanism to scan binary files Message-ID: References: <20240218173809.work.286-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240218173809.work.286-kees@kernel.org> Hi Kees, On Sun, Feb 18, 2024 at 09:38:12AM -0800, Kees Cook wrote: > Introduce --kallsyms argument for scanning binary files for known symbol > addresses. This would have found the exposure in /sys/kernel/notes: > > $ scripts/leaking_addresses.pl --kallsyms=<(sudo cat /proc/kallsyms) > /sys/kernel/notes: hypercall_page @ 156 > /sys/kernel/notes: xen_hypercall_set_trap_table @ 156 > /sys/kernel/notes: startup_xen @ 132 > > Signed-off-by: Kees Cook Patch itself is Reviewed-by: Tycho Andersen And if you can carry it, that would be great (see below :). This does bring up some interesting questions. From off-list discussions with Tobin, I believe he is not particularly interested in maintaining this script any more. I was never set up to do the PRs myself, I agreed to be a reviewer to help Tobin out. I'm happy to adopt it if that makes sense, but I'm curious about the future of the script: 1. is it useful? (seems like yes if you're adding features) 2. does it make sense to live here as a separate thing? should we perhaps run it as part of kselftests or similar? I think that e.g. 681ff0181bbf ("x86/mm/init/32: Stop printing the virtual memory layout") was not discovered with this script, but maybe if we put it inline with some other stuff people regularly run more of these would fall out? Maybe it makes sense to live somewhere else entirely (syzkaller)? I can probably set up some x86/arm64 infra to run it regularly, but that won't catch other less popular arches. 3. perl. I'm mostly not a perl programmer, but would be happy to rewrite it in python pending the outcome of discussion above. Thoughts? Tycho