10

i'm writing the code about low-level stuff. i need to know kernel symbol addresses to write reliable code. So im trying to read the kallsyms when im in user-mode in Ubuntu kernel-3.0.19. and that's kallsyms output in user-mode.

... 00000000 r __ksymtab_prepare_kernel_cred 00000000 r __kcrctab_prepare_kernel_cred 00000000 r __kstrtab_prepare_kernel_cred ...

how can i solve this problem in user-mode. when im root and everyting's ok but that's not what i need.

thanks.

1 Answer 1

13

It is intentional that /proc/kallsyms shows zeros instead of the real addresses for a non-root user. This lowers the security risk a bit.

The details are available in this upstream commit. See also how %pK print specifier is used in s_show() function in kallsyms.c, s_show being responsible for providing a record in /proc/kallsyms.

I doubt it is still possible to get symbol addresses somehow without being a root user. One can not access System.map without root privileges either. Same for writing to /proc/sys/kernel/kptr_restrict.

4
  • One can not access System.map without root privileges either. On my RHEL server it is allowed to read this file /boot/System.map-...
    – user184968
    Sep 6, 2013 at 10:15
  • Depends on the distro and/or the kernel version, I guess. If System.map contains the addresses of the kernel functions and is readable to a non-root user by default, this actually makes the protection of kallsyms useless. If it is RHEL 6, the kernel is likely to be 2.6.32, IIRC, where /proc/kallsyms was not protected. So readable System.map file does not increase the security risks in that case.
    – Eugene
    Sep 7, 2013 at 17:53
  • If you're using a kernel compiled by the distribution, you could just see the distribution archives for appropriate System.map, no?
    – domen
    Sep 11, 2013 at 14:29
  • @domen: good point. Yes, you usually can. And it may weaken security significantly unless something like address space layout randomization comes into play. The latter is also not a panacea though.
    – Eugene
    Sep 11, 2013 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.