components: recover the kernel image base from kernfs seek cookies

kernfs derives each /sys directory entry's readdir seek cookie (d_off)
from a name hash salted with the entry's namespace tag. For a reader in
the initial network namespace the tag of every /sys/class/net entry is
&init_net, a KASLR-linked kernel-image global, so the cookies leak a
hash of it. The name-hash fold is affine in the salt, so testing each
candidate kernel base recovers the &init_net that reproduces every
observed cookie; a per-build init_net-from-_text offset then pins the
image base. The value is a seek cookie, not a %p, so it is independent
of kptr_restrict, and a plain readdir needs no privilege.

Fixed upstream in v7.0 (salt switched to the namespace id); live on
every earlier kernel. Recovery searches the KASLR base grid and runs
where that grid is tractable, folding as hash_32 or hash_64 by word
size. s390x and ppc64/ppc64le, whose windows hold billions of bases,
are a sound no-op, as is a 32-bit build whose ±2^31 cookie alias is
also in-window.

Author: bcoles

Makefile

@@ -639,6 +639,15 @@ $(TEST_KCORE_BIN): $(TEST_DIR)/test_kcore.c $(SRC_DIR)/components/proc_kcore.c $
 	$(call ccv,CCLD,$@)
 	$(Q)$(CC) $(TEST_ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $(TEST_DIR)/test_kcore.c -o $@
 
+# kernfs_ns_hash salt recovery: the component #included (main renamed) and its
+# pure recovery functions exercised over synthesised cookies — unique recovery,
+# the offset-table base pin, the patched-kernel no-op, and salt discrimination.
+# Host-agnostic (no live getdents64; the seek-cookie path cannot be staged).
+TEST_KERNFS_BIN := $(TEST_OBJ_DIR)/test_kernfs_ns_hash
+$(TEST_KERNFS_BIN): $(TEST_DIR)/test_kernfs_ns_hash.c $(SRC_DIR)/components/kernfs_ns_hash.c $(HDRS) | $(TEST_OBJ_DIR)
+	$(call ccv,CCLD,$@)
+	$(Q)$(CC) $(TEST_ALL_CFLAGS) $(ALL_LDFLAGS) -I$(SRC_DIR) $(TEST_DIR)/test_kernfs_ns_hash.c -o $@
+
 # sysfs / ACPI / DT leak-parser tests: each component #included (main renamed)
 # and driven over a staged KASLD_SYSROOT fixture tree reproducing the kernel ABI.
 TEST_PARSERS_SRCS := $(SRC_DIR)/components/sysfs_efi_runtime_map.c \
@@ -697,7 +706,8 @@ TEST_ALL_BINS := $(TEST_BIN) \
   $(TEST_DMESG_RESV_BIN) \
   $(TEST_BPE820_BIN) \
   $(TEST_PARSERS_BIN) \
-  $(TEST_KCORE_BIN)
+  $(TEST_KCORE_BIN) \
+  $(TEST_KERNFS_BIN)
 
 $(TEST_ALL_BINS): $(TEST_HDRS)
 

src/components/kernfs_ns_hash.c

@@ -58,7 +58,9 @@ COMP=$ROOT/src/components
 #                                    (ioctls the running kernel's GPU device)
 #   /dev/snd/seq                   — ALSA sequencer data.ext.ptr leak (drives
 #                                    the running kernel's sequencer)
-SIG='perf_event_open|SYS_perf_event_open|__NR_perf_event_open|rdtsc|sidechannel\.h|mincore[[:space:]]*\(|sidt|/proc/self/syscall|getppid[[:space:]]*\(|PF_CAN|AF_CAN|NILFS_IOCTL|FBIOGET_FSCREENINFO|TIOCGSERIAL|pppd|SYS_bpf|BPF_PROG_LOAD|KBASE_IOCTL|/dev/mali|/dev/snd/seq'
+#   SYS_getdents64                 — kernfs seek-cookie leak (reads the running
+#                                    kernel's live /sys/class/net directory)
+SIG='perf_event_open|SYS_perf_event_open|__NR_perf_event_open|rdtsc|sidechannel\.h|mincore[[:space:]]*\(|sidt|/proc/self/syscall|getppid[[:space:]]*\(|PF_CAN|AF_CAN|NILFS_IOCTL|FBIOGET_FSCREENINFO|TIOCGSERIAL|pppd|SYS_bpf|BPF_PROG_LOAD|KBASE_IOCTL|/dev/mali|/dev/snd/seq|SYS_getdents64'
 
 # Reviewed live probes whose liveness is not greppable: mmap VA-boundary sweeps
 # (mmap alone is too common a call to signature on) and the iret CPU probe. Keep

src/components/offsets/kernfs_ns_hash.inc

@@ -62,6 +62,7 @@ allow_file() {
   proc_kallsyms.c) return 0 ;;          # _stext, read by name
   pppd_kallsyms.c) return 0 ;;          # a named symbol's address
   bpf_verifier_ksym.c) return 0 ;;      # ksym resolved through the uname-keyed table
+  kernfs_ns_hash.c) return 0 ;;         # &init_net, the unique salt of the net-tagged sysfs hashes
   dmesg_android_ion_snapshot.c) return 0 ;; # the last_ion_buf symbol's address
   dmesg_mmu_idmap.c) return 0 ;;        # virt_to_phys(__idmap_text), a named section
   # An instruction address: whatever executed was text.
@@ -133,7 +134,7 @@ done
 
 # An allowlist entry naming a component that no longer claims text is stale, and
 # a stale entry is how the next real offender gets waved through.
-for stale in proc_kallsyms pppd_kallsyms bpf_verifier_ksym dmesg_android_ion_snapshot \
+for stale in proc_kallsyms pppd_kallsyms bpf_verifier_ksym kernfs_ns_hash dmesg_android_ion_snapshot \
   dmesg_mmu_idmap perf_event_open perf_lbr_sampling perf_amd_branch_user \
   perf_text_poke_leak \
   dmesg_backtrace dmesg_ex_handler_msr qemu_tcg_iret proc_stat_wchan proc_kcore \

tests/check-live-probes

@@ -28,7 +28,7 @@ else
 fi
 
 # Suite binaries (smallest first).
-SUITES="test_evidence test_estimate test_align test_addr_parse test_target_width test_task_size test_prefetch_scan test_cpu test_outcome test_text_order test_kernel_image test_engine_integration test_kasld test_render test_engine test_dmesg_layout test_dmesg_backtrace test_boot_config test_dmesg_kaslr_disabled test_sysfs_devicetree_memory test_proc_net_sock_ptr test_proc_timer_list test_proc_kallsyms test_tracefs_available_filter_addrs test_btf test_dmesg_reservations test_boot_params_e820 test_sysfs_parsers test_kcore"
+SUITES="test_evidence test_estimate test_align test_addr_parse test_target_width test_task_size test_prefetch_scan test_cpu test_outcome test_text_order test_kernel_image test_engine_integration test_kasld test_render test_engine test_dmesg_layout test_dmesg_backtrace test_boot_config test_dmesg_kaslr_disabled test_sysfs_devicetree_memory test_proc_net_sock_ptr test_proc_timer_list test_proc_kallsyms test_tracefs_available_filter_addrs test_btf test_dmesg_reservations test_boot_params_e820 test_sysfs_parsers test_kcore test_kernfs_ns_hash"
 
 total_pass=0
 total_count=0

tests/check-text-provenance

@@ -0,0 +1,112 @@
+// This file is part of KASLD - https://github.com/bcoles/kasld
+//
+// Unit tests for kernfs_ns_hash's salt recovery, driven directly over the
+// component's pure functions (the live getdents64 path cannot be staged through
+// a KASLD_SYSROOT, which stages file contents, not directory seek cookies).
+//
+// Pins four behaviours:
+//   1. Unique recovery. Cookies synthesised from a known kernel-VA salt recover
+//      exactly that salt from the surrounding window.
+//   2. Offset-table pin. Walking the KASLR base grid with a build offset
+//      recovers base + off, so the caller derives the true base.
+//   3. Patched no-op. Cookies salted with a small ns_id (the post-fix salt)
+//      have NO kernel-VA solution, so recovery emits nothing.
+//   4. Discrimination. A wrong salt does not reproduce the cookies.
+// ---
+// <bcoles@gmail.com>
+#define _GNU_SOURCE
+
+int kernfs_ns_hash_main(int argc, char **argv);
+#define main kernfs_ns_hash_main
+#include "../src/components/kernfs_ns_hash.c"
+#undef main
+
+#include "test_harness.h"
+
+#include <assert.h>
+#include <stdint.h>
+#include <string.h>
+
+/* Build the (name, cookie) constraints a reader would harvest if every entry
+ * were tagged with `salt`. */
+static int build_pairs(unsigned long salt, const char *const *names, int n,
+                       struct kernfs_pair *pr) {
+  for (int i = 0; i < n; i++) {
+    kernfs_affine(names[i], &pr[i].pow11, &pr[i].cname);
+    pr[i].hash = kernfs_fold((uint64_t)salt * pr[i].pow11 + pr[i].cname);
+  }
+  return n;
+}
+
+static const char *const NAMES[] = {"lo", "ens33", "docker0", "virbr0"};
+
+/* A word-aligned synthetic &init_net and a 2 MiB-aligned base, sized to the
+ * target word width so the 32-bit builds (run under test-cross) exercise the
+ * hash_32 fold and the 64-bit build exercises hash_64. The values are
+ * arbitrary; only their recovery matters. */
+#if __SIZEOF_LONG__ == 8
+#define SALT_A 0xffffffff8e773d40UL
+#define BASE_B 0xffffffff8c000000UL
+#else
+#define SALT_A 0x8e773d40UL
+#define BASE_B 0x8c000000UL
+#endif
+
+/* Cookies from a known salt recover exactly that salt from its window. */
+static void test_recovers_known_salt(void) {
+  struct kernfs_pair pr[4];
+  int n = build_pairs(SALT_A, NAMES, 3, pr);
+  unsigned long got = 0;
+  int ok = kernfs_scan(pr, n, SALT_A - 0x2000, SALT_A + 0x2000, sizeof(long), 0,
+                       &got);
+  assert(ok == 1);
+  assert(got == SALT_A);
+}
+
+/* With a build offset, walking the aligned base grid recovers base + off. */
+static void test_offset_table_pin(void) {
+  unsigned long base = BASE_B; /* 2 MiB aligned */
+  uint32_t off = 0x00773d40;   /* init_net - _text (word aligned) */
+  unsigned long salt = base + off;
+  struct kernfs_pair pr[4];
+  int n = build_pairs(salt, NAMES, 3, pr);
+  unsigned long align = 0x200000UL;
+  unsigned long got = 0;
+  int ok =
+      kernfs_scan(pr, n, base - 4 * align, base + 4 * align, align, off, &got);
+  assert(ok == 1);
+  assert(got == salt);       /* == &init_net */
+  assert(got - off == base); /* caller derives the true base */
+}
+
+/* Post-fix the salt is a small ns_id integer; no kernel-VA candidate reproduces
+ * those cookies, so recovery finds nothing (a sound no-op). */
+static void test_patched_is_noop(void) {
+  unsigned long ns_id = 0x4002; /* small non-pointer salt */
+  struct kernfs_pair pr[4];
+  int n = build_pairs(ns_id, NAMES, 3, pr);
+  unsigned long got = 0;
+  int ok = kernfs_scan(pr, n, SALT_A - 0x4000, SALT_A + 0x4000, sizeof(long), 0,
+                       &got);
+  assert(ok == 0);
+}
+
+/* The true salt passes the cookie check; an adjacent one does not. */
+static void test_wrong_salt_rejected(void) {
+  struct kernfs_pair pr[4];
+  int n = build_pairs(SALT_A, NAMES, 3, pr);
+  assert(kernfs_salt_ok(SALT_A, pr, n) == 1);
+  assert(kernfs_salt_ok(SALT_A + sizeof(long), pr, n) == 0);
+  assert(kernfs_salt_ok(SALT_A - sizeof(long), pr, n) == 0);
+}
+
+int main(void) {
+  TEST_SUITE("kernfs_ns_hash");
+  BEGIN_CATEGORY("salt recovery");
+  RUN(test_recovers_known_salt);
+  RUN(test_offset_table_pin);
+  BEGIN_CATEGORY("soundness");
+  RUN(test_patched_is_noop);
+  RUN(test_wrong_salt_rejected);
+  return TEST_DONE();
+}