Vous n'êtes pas connecté. Ce forum permet seulement les utilisateurs connectés pour poster. Si vous voulez faire un post sur le forum, s'il vous plaît connecter.
Get Security_hook_heads address errors (2020-11-10 15:39 by hello_sir #86137)
Hello, everybody:
I recently met a problem, the details are as follows:
System information:
root@greatwall-os:~# uname -a
Linux greatwall-os 4.4.131-20200115.kylin.desktop-generic #kylin SMP Wed Jan 15 09:20:22 CST 2020 aarch64 aarch64 aarch64 GNU/Linux
root@greatwall-os:~#
Code segment:
/* Guess "struct security_hook_heads security_hook_heads;". */
cp = probe_find_variable(probe_security_bprm_committed_creds,
((unsigned long)
&probe_dummy_security_hook_heads) + offset,
" security_bprm_committed_creds\n");
if (!cp) {
printk(KERN_ERR
"Can't resolve security_bprm_committed_creds().\n");
return NULL;
}
printk(KERN_ERR
"Success security_bprm_committed_creds().\n");
/* This should be "struct security_hook_heads security_hook_heads;". */
shh = ((void *) (*(unsigned long *) cp)) - offset;
printk(KERN_ERR "security_hook_heads is 0x%lx\n",
(unsigned long) shh);
Output information:
Success security_bprm_committed_creds().
security_hook_heads is 0xffffffc00238f000
But the system shows as follows:
root@greatwall-os:~# cat /boot/System.map-4.4.131-20200115.kylin.desktop-generic |grep security_hook_heads
ffffffc00238f480 D security_hook_heads
root@greatwall-os:~#
I think may be probe_security_hook_heads_on_arm64 function calculation error.
Re: Get Security_hook_heads address errors (2020-11-10 19:04 by kumaneko #86140)
> I think may be probe_security_hook_heads_on_arm64 function calculation error.
Re: Get Security_hook_heads address errors (2020-11-16 20:22 by kumaneko #86175)
> Is there any solution?
No solution, for embedding complete ARM64 decoder will be too much. I might have to prepare an ARM64 environment for debugging.
I found a higher priority problem that /proc/kallsyms became no longer readable from kernel using kernel_read() in Linux 5.10.
This change affects all architectures. If there is no answer to this problem, we might need to give up automatic guessing of kernel functions.
> Oh my god, I recompile the security/security.o file.
Can you examine why you got different byte sequences by recompiling?
Use of same compiler version, same kernel source and same kernel config should result in same byte sequences.