1

This file is readable for all users: /proc/kallsyms

This file contains addresses for each kernel symbol (when i am root)

but when i am a classic user, i only see 0x00000000 address.

Is there a way to allow a classic user to see the addresses (i am root on the computer)

Thanks

3
  • Possible duplicate of Reading kallsyms in user-mode Apr 9, 2019 at 11:16
  • echo 0 > /proc/sys/kernel/kptr_restrict Apr 9, 2019 at 11:19
  • This is not true, i have tried to put 0 in this file and it does not change anything. I still have 0x00000 addresses with my non-root user
    – Bob5421
    Apr 9, 2019 at 11:49

2 Answers 2

3

As the source code snippet posted by Jonathon Reinhart shows, regular users can view the addresses in /proc/kallsyms when both /proc/sys/kernel/kptr_restrict and /proc/sys/kernel/perf_event_paranoid are set to 0.

The following works for me on Kernel version 5.3.0:

$ echo 0 | sudo tee /proc/sys/kernel/kptr_restrict > /dev/null
$ echo 0 | sudo tee /proc/sys/kernel/perf_event_paranoid > /dev/null
$ head /proc/kallsyms
1

The kernel documentation says:

kptr_restrict:

This toggle indicates whether restrictions are placed on
exposing kernel addresses via /proc and other interfaces.

When kptr_restrict is set to 0 (the default) the address is hashed before
printing. (This is the equivalent to %p.)

When kptr_restrict is set to (1), kernel pointers printed using the %pK
format specifier will be replaced with 0's unless the user has CAP_SYSLOG
and effective user and group ids are equal to the real ids. This is
because %pK checks are done at read() time rather than open() time, so
if permissions are elevated between the open() and the read() (e.g via
a setuid binary) then %pK will not leak kernel pointers to unprivileged
users. Note, this is a temporary solution only. The correct long-term
solution is to do the permission checks at open() time. Consider removing
world read permissions from files that use %pK, and using dmesg_restrict
to protect against uses of %pK in dmesg(8) if leaking kernel pointer
values to unprivileged users is a concern.

When kptr_restrict is set to (2), kernel pointers printed using
%pK will be replaced with 0's regardless of privileges.

Whether or not /proc/kallsyms shows actual symbol values is controlled by kallsyms_show_value in kernel/kallsyms.c:

/*
 * We show kallsyms information even to normal users if we've enabled
 * kernel profiling and are explicitly not paranoid (so kptr_restrict
 * is clear, and sysctl_perf_event_paranoid isn't set).
 *
 * Otherwise, require CAP_SYSLOG (assuming kptr_restrict isn't set to
 * block even that).
 */
int kallsyms_show_value(void)
{
    switch (kptr_restrict) {
    case 0:
        if (kallsyms_for_perf())
            return 1;
    /* fallthrough */
    case 1:
        if (has_capability_noaudit(current, CAP_SYSLOG))
            return 1;
    /* fallthrough */
    default:
        return 0;
    }
}

So if you are a normal user without any capabilities(7), you cannot see kernel symbol values.

What exactly are you trying to accomplish? If you are writing a (compiled) application, you can could apply the CAP_SYSLOG file capability to your executable.

2
  • I have put 0 in /proc/sys/kernel/kptr_restrict and i still see 000000 addresses. I am not trying to accomplish anything, i just want to understand
    – Bob5421
    Apr 10, 2019 at 10:21
  • i have tried to type this: it does not change anything sudo /sbin/setcap 'cap_syslog+ep' /bin/bash
    – Bob5421
    Apr 10, 2019 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.