Re: [PATCH 3/5] module: Do not expose section addresses to non-CAP_SYSLOG

Jessica Yu
2020-07-08T16:12:49Z

+++ Kees Cook [02/07/20 16:26 -0700]:
>The printing of section addresses in /sys/module/*/sections/* was not
>using the correct credentials to evaluate visibility.
>
>Before:
>
> # cat /sys/module/*/sections/.*text
> 0xffffffffc0458000
> ...
> # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
> 0xffffffffc0458000
> ...
>
>After:
>
> # cat /sys/module/*/sections/*.text
> 0xffffffffc0458000
> ...
> # capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
> 0x0000000000000000
> ...
>
>Additionally replaces the existing (safe) /proc/modules check with
>file->f_cred for consistency.
>
>Cc: stable@vger.kernel.org
>Reported-by: Dominik Czarnota <dominik.czarnota@trailofbits.com>
>Fixes: be71eda5383f ("module: Fix display of wrong module .text address")
>Signed-off-by: Kees Cook <keescook@chromium.org>

Tested-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>