kprobes: Do not expose probe addresses to non-CAP_SYSLOG

The kprobe show() functions were using "current"'s creds instead of the file opener's creds for kallsyms visibility. Fix to use seq_file->file->f_cred. Cc: Masami Hiramatsu <[email protected]> Cc: [email protected] Fixes: 81365a9 ("kprobes: Show address of kprobes if kallsyms does") Fixes: ffb9bd6 ("kprobes: Show blacklist addresses as same as kallsyms does") Signed-off-by: Kees Cook <[email protected]>
ashr · Jul 8, 2020 · 60f7bb6 · 60f7bb6
1 parent b25a7c5
commit 60f7bb6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
@@ -2448,7 +2448,7 @@ static void report_probe(struct seq_file *pi, struct kprobe *p,
 	else
 		kprobe_type = "k";
 
-	if (!kallsyms_show_value(current_cred()))
+	if (!kallsyms_show_value(pi->file->f_cred))
 		addr = NULL;
 
 	if (sym)
@@ -2540,7 +2540,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
 	 * If /proc/kallsyms is not showing kernel address, we won't
 	 * show them here either.
 	 */
-	if (!kallsyms_show_value(current_cred()))
+	if (!kallsyms_show_value(m->file->f_cred))
 		seq_printf(m, "0x%px-0x%px\t%ps\n", NULL, NULL,
 			   (void *)ent->start_addr);
 	else