RE: [PATCH] printk: introduce kptr_restrict level 3

[Roberts, William C]

> -----Original Message-----
> From: Christoph Hellwig [mailto:hch@xxxxxxxxxxxxx]
> Sent: Thursday, October 6, 2016 9:56 AM
> To: Roberts, William C <william.c.roberts@xxxxxxxxx>
> Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx>; kernel-
> hardening@xxxxxxxxxxxxxxxxxx; corbet@xxxxxxx; linux-doc@xxxxxxxxxxxxxxx;
> linux-kernel@xxxxxxxxxxxxxxx
> Subject: Re: [PATCH] printk: introduce kptr_restrict level 3
> 
> On Thu, Oct 06, 2016 at 01:47:47PM +0000, Roberts, William C wrote:
> > Out of tree modules still affect core kernel security.
> 
> So don't use them.
> 
> > I would also bet money, that somewhere In-tree someone has put a %p
> > when they wanted a %pK.
> 
> So fix them.

As Jann Horn points out, "And in total, there are 13578 matches for %p[^FfSsBRrhbMmIiEUVKNadCDgG] throughout the kernel. Reviewing all of those manually would suck."

> 
> > So this method is just quite error
> > prone. We currently have a blacklist approach versus whitelist.
> 
> Or fix the entire thing, get rid of %pK and always protect %p if you can show that
> it doesn't break anything.
> 
> But stop posting patches with bullshit arguments like out of tree modules.

Ok perhaps the commit message sucks, and I should have included the large spread usages of %p throughout
the kernel, I assumed those would just be known, I shouldn't have made that assumption.

We should care about out-of-tree modules wrt security as they affect the security of the whole system, especially when the
modules are linking to core symbols like printing and string routines. There are tons of %p usages throughout the
kernel as noted above.

This is pretty low hanging fruit and we should fix this, as Kees points out.