linux-kernel - Re: [PATCH RESEND] kprobes: Blacklist risky functions from being probed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251204145013.GN2528459@noisy.programming.kicks-ass.net>
Date: Thu, 4 Dec 2025 15:50:13 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: ellyndra <ellyesparza8@...il.com>
Cc: linux-kernel@...r.kernel.org, luto@...nel.org, tglx@...utronix.de,
	mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
	x86@...nel.org, paul@...l-moore.com, jmorris@...ei.org,
	serge@...lyn.com
Subject: Re: [PATCH RESEND] kprobes: Blacklist risky functions from being
 probed

On Thu, Dec 04, 2025 at 11:41:41AM -0300, ellyndra wrote:
> From: Elly I Esparza <ellyesparza8@...il.com>
> 
> Blacklist 'x64_sys_call()' from being kprobed to prevent syscall hooking
> techniques that overwrite the content of a 'case' block inside the main
> syscall dispatch switch statement.
> 
> Also blacklist 'kallsyms_lookup_name()' to prevent a potential bypass
> of the blacklist, since this function can be used to discover and target
> arbitrary kernel symbols.
> 
> Add a Kconfig option under security/ to enable or disable this feature.
> 
> Signed-off-by: Elly I Esparza <ellyesparza8@...il.com>
> ---

I'd be okay doing this unconditionally. Pretty much everything else
until that point lives in noinstr which is already excluded from probes.