[javanix]

How do you find those addresses?

[wfn]

By looking at /proc/kallsyms:

  grep commit_creds /proc/kallsyms
  grep prepare_kernel_cred /proc/kallsyms

Then update addresses as shown in one of the code snippets:

  _commit_creds commit_creds = 0xffffffff81094250;
  _prepare_kernel_cred prepare_kernel_cred = 0xffffffff81094550;

[Maran]

Question for you.

As a normal user, grepping these values I actually get 0000000000000000. I can't imagine these being the actual values. Is it possible that because I remount my /proc with the hidepid=2 option the values are not visible for normal non-root accounts?

[javanix]

Thanks, that worked.

[agwa]

Grep for commit_creds and prepare_kernel_cred in /proc/kallsyms. The address is in the first column.

[fuuuuuuuuu]

https://gist.github.com/gcmurphy/1c91644718d28695da2d

^-- this version should do that automatically