Hide kernel addresses

Why it matters

Many kernel exploits need to know exactly where particular code or data sits in memory. Kernel addresses can leak through several interfaces, and an attacker who already runs a program on your computer can collect them and aim an exploit precisely. Hiding them fixes no bug, but it takes away a map the attacker would otherwise use.

How it works

Sets the kernel parameter kernel.kptr_restrict to 2. Kernel pointers printed with the %pK format are then replaced with zeros for every user, including root. Value 1 hides them only from users without the CAP_SYSLOG capability.

Who should use it

Fits nearly every desktop and server. Leave it at 0 or 1 if you debug the kernel itself, or run profiling tools on a development machine that need real kernel addresses.

What you may notice

Usually nothing. Tools such as perf may warn that kernel address maps are restricted, and /proc/kallsyms shows zeros even to root.

Check it on your computer

Read the current value:

sysctl kernel.kptr_restrict

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.kptr_restrict=2

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-kptr-restrict.conf <<'EOF'
kernel.kptr_restrict = 2
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Keep the kernel log for administrators
• Restrict performance events

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

kernel.kptr_restrict