linux-hardening - Re: tracepoints and %p [was: Re: [Patch net-next resend v2] net: use %px to print skb address in trace_netif_receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 28 Jul 2021 16:41:03 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Jann Horn <jannh@...gle.com>, Ingo Molnar <mingo@...nel.org>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Qitao Xu <qitao.xu@...edance.com>,
        "David S. Miller" <davem@...emloft.net>,
        Network Development <netdev@...r.kernel.org>,
        Cong Wang <cong.wang@...edance.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-hardening@...r.kernel.org
Subject: Re: tracepoints and %p [was: Re: [Patch net-next resend v2] net:
 use %px to print skb address in trace_netif_receive_skb]

On Wed, 28 Jul 2021 11:48:11 -0700
Kees Cook <keescook@...omium.org> wrote:

> > That is exactly what is happening. I wrote the following to the replied
> > text up at the top, then noticed you basically stated the same thing
> > here ;-)  
> 
> Where is the %px being formatted then? If it's the kernel itself (which
> is the only thing that does %px), then it doesn't need to be %px, since
> the raw data is separate. i.e. leave it %p for whatever logs will get
> spilled out to who knows where.

The trace events shown by tracefs/trace are formatted via the kernel
sprintf() and friends, which will hash "%p".

But the raw data read to trace-cmd (and other tools), uses
libtraceevent, that parses the printf-fmt of a trace event just like
the kernel does. But since we are already in user space, it is pretty
pointless to implement "%p" with hashing. But it does understand what
"%px" is.

> 
> How does ftrace interact with lockdown's confidentiality mode?
> 

as Jann replied. If you enable "LOCKDOWN_TRACEFS" you lose all access
to the tracing interface.

-- Steve