Skip to content
Commit 5ddf57cb authored by Kees Cook's avatar Kees Cook Committed by Paul Gortmaker
Browse files

module: Do not expose section addresses to non-CAP_SYSLOG

commit b25a7c5a

 upstream.

The printing of section addresses in /sys/module/*/sections/* was not
using the correct credentials to evaluate visibility.

Before:

 # cat /sys/module/*/sections/.*text
 0xffffffffc0458000
 ...
 # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
 0xffffffffc0458000
 ...

After:

 # cat /sys/module/*/sections/*.text
 0xffffffffc0458000
 ...
 # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
 0x0000000000000000
 ...

Additionally replaces the existing (safe) /proc/modules check with
file->f_cred for consistency.

Reported-by: default avatarDominik Czarnota <dominik.czarnota@trailofbits.com>
Fixes: be71eda5

 ("module: Fix display of wrong module .text address")
Cc: stable@vger.kernel.org
Tested-by: default avatarJessica Yu <jeyu@kernel.org>
Acked-by: default avatarJessica Yu <jeyu@kernel.org>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarPaul Gortmaker <paul.gortmaker@windriver.com>
parent e9c6bd86
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment