[PATCH] security: Restrict unprivileged access to /proc/config.gz

[PATCH] security: Restrict unprivileged access to /proc/config.gz

[Vic B]

When using CONFIG_IKCONFIG_PROC, the built-in configuration is
world-readable through /proc/config.gz, which somewhat weakens existing
address hiding defences, as it allows an unprivileged user to simply
read built-in config from the running kernel and build their own copy
with identical System.map.

This patch adds a configuration option to restrict access to
/proc/config.gz to superuser only.

Signed-off-by: Vic B <linux@vicb.net>
---
 kernel/configs.c |  8 +++++++-
 security/Kconfig | 27 +++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/kernel/configs.c b/kernel/configs.c
index a28c79c5f713..11106164756f 100644
--- a/kernel/configs.c
+++ b/kernel/configs.c
@@ -37,6 +37,12 @@ asm (
 extern char kernel_config_data;
 extern char kernel_config_data_end;
 
+#ifdef CONFIG_SECURITY_IKCONFIG_RESTRICT
+#define IKCONFIG_MODE S_IRUSR
+#else
+#define IKCONFIG_MODE S_IRUGO
+#endif
+
 static ssize_t
 ikconfig_read_current(struct file *file, char __user *buf,
 		      size_t len, loff_t * offset)
@@ -57,7 +63,7 @@ static int __init ikconfig_init(void)
 	struct proc_dir_entry *entry;
 
 	/* create the current config file */
-	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
+	entry = proc_create("config.gz", S_IFREG | IKCONFIG_MODE , NULL,
 			    &config_gz_proc_ops);
 	if (!entry)
 		return -ENOMEM;
diff --git a/security/Kconfig b/security/Kconfig
index f7bf6cdc6229..0e8b8947150a 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -19,6 +19,33 @@ config SECURITY_DMESG_RESTRICT
 
 	  If you are unsure how to answer this question, answer N.
 
+config SECURITY_IKCONFIG_RESTRICT
+	bool "Restrict unprivileged access to /proc/config.gz"
+	depends on IKCONFIG_PROC
+	default n
+	help
+	  The built-in configuration of the running kernel may be used to build
+	  an identical kernel and expose information about kernel addresses,
+	  which can make exploiting easier.
+
+	  Selecting this option makes the built-in configuration in
+	  /proc/config.gz readable to superuser only.
+
+	  This is mostly useful with custom kernels, as distribution kernels
+	  tend to have their configuration and address maps available online.
+
+	  If you decide to restrict access to built-in config with this option
+	  for the above reasons, you should also make sure that access to the
+	  on-disk kernel image, configuration and System.map is restricted as
+	  well, e.g. by making the /boot directory accessible to superuser
+	  only.
+
+	  When using packaged kernels or image-based updaters, keep in mind
+	  that kernel packages or update images may also be accessible to
+	  unprivileged users via package manager or updater caches, or from
+	  network repositories. In such cases it's a good idea to restrict
+	  access to these as well.
+
 choice
 	prompt "Allow /proc/pid/mem access override"
 	default PROC_MEM_FORCE_PTRACE
-- 
2.47.3

Re: [PATCH] security: Restrict unprivileged access to /proc/config.gz

[Greg KH]

On Sun, Nov 08, 2026 at 03:23:51PM +0100, Vic B wrote:
> When using CONFIG_IKCONFIG_PROC, the built-in configuration is
> world-readable through /proc/config.gz, which somewhat weakens existing
> address hiding defences, as it allows an unprivileged user to simply
> read built-in config from the running kernel and build their own copy
> with identical System.map.
> 
> This patch adds a configuration option to restrict access to
> /proc/config.gz to superuser only.
> 
> Signed-off-by: Vic B <linux@vicb.net>

Full name please.

But really, a .config file is not a secret, this isn't needed, sorry.

greg k-h

Re: [PATCH] security: Restrict unprivileged access to /proc/config.gz

[Vic B]

On Mon, Nov 09, 2026 at 03:38:16PM -0500, Greg KH wrote:
> On Sun, Nov 08, 2026 at 03:23:51PM +0100, Vic B wrote:
> > When using CONFIG_IKCONFIG_PROC, the built-in configuration is
> > world-readable through /proc/config.gz, which somewhat weakens existing
> > address hiding defences, as it allows an unprivileged user to simply
> > read built-in config from the running kernel and build their own copy
> > with identical System.map.
> > 
> > This patch adds a configuration option to restrict access to
> > /proc/config.gz to superuser only.
> > 
> > Signed-off-by: Vic B <linux@vicb.net>
> 
> Full name please.
> 
> But really, a .config file is not a secret, this isn't needed, sorry.

On all my systems (Debian + mainline kernel) the .config file actually
reveals System.map - all that's needed to get matching (fully identical)
System.map is to grab the config and build mainline kernel sources of
the running version under highly predictable build environment (i.e.,
under same distro, which is also strongly indicated by the fact
that the running kernels are installed as deb packages).

So the goal of hiding .config is to hide System.map, for same resons why
there's kptr_restrict in /proc/sys/kernel.

In particular, the problem I'm trying to avoid is that if an attacker
learns even one runtime address, with matching System.map (or just
.config in my case), they may calculate KASLR offset and derive
addresses of other symbols (more precisely, as I don't use
CONFIG_MODULES, all other symbols).

If access restrictitions on /proc/config.gz aren't needed, the only
solution probably is to disable CONFIG_IKCONFIG_PROC (which
actually is kind of access restriction anyway). May be feasible,
but I'm gonna miss /proc/config.gz...

Vic

> greg k-h
>