re: bin/58630: dtrace is "hit or miss", but mostly "miss"

[matthew green <mrg%eterna23.net@localhost>]

>  Is /dev/ksyms world-readable on the other systems, or is dtrace setuid there?

some time between netbsd-7 and netbsd-9 the default for /dev/ksyms
changed from 444 to 440.  ah, here it is:

date: 2018-07-21 00:46:56 -0700;  author: maxv;  state: Exp;  lines: +2 -2;  commitid: 4dw22L6uN8Y2AYKA;
Create /dev/ksyms as "440 $g_kmem". This prevents unprivileged users from
reading the kernel symbols. Discussed in January 2018 on tech-kern@,
reported by maya@, tested by tih@.

>  I wonder if something like this would do instead of reading from /dev/ksyms?
[ .. ]
>  +		if (sysctlbyname("machdep.booted_kernel", tmp, &len, NULL, 0) == 0) 

no, this doesn't work if the boot media isn't mounted
and it doesn't support modules, or KALSR, or in the case
i've installed a new /netbsd but haven't yet rebooted.

this is a caveat of dtrace that i don't see - i normally
run it as root.  one could enable access to /dev/ksyms
by accepting the info leak (kernel addresses) to all or
perhaps making relevant users part of kmem group.

we could make dtrace more obvious about this failure mode.


.mrg.