Datasetpublic

mjbommar/linux-ioctl-census

Linux IOCTL Census -- public structural tier A source-derived census of the Linux kernel local ioctl/proc/sysfs handler surface: for each registered handler, its decoded _IOC command table, the permission gates on its path, and a capability-ungated reachability upper bound. The schema is identical to the Windows IOCTL Census (mjbommar/ioctl-census), so the two can be queried and compared together. This is the public structural tier: everything derivable from the already-public… See the full description on the dataset page: https://huggingface.co/datasets/mjbommar/linux-ioctl-census.

sourceHugging Facecc-by-4.0updated 4mo agoView on Hugging Face

1likes48downloads

Dataset Card

Linux IOCTL Census -- public structural tier

A source-derived census of the Linux kernel local ioctl/proc/sysfs handler surface: for each registered handler, its decoded _IOC command table, the permission gates on its path, and a capability-ungated reachability upper bound. The schema is identical to the Windows IOCTL Census (mjbommar/ioctl-census), so the two can be queried and compared together.

This is the public structural tier: everything derivable from the already-public kernel source. The targeting tier (controlled-input sinks, LLM triage, ranked unaudited surface) is intentionally withheld.

Tables

table	rows	what
`binaries`	878	one row per driver source file that registers a handler (module granularity)
`dispatchers`	2914	registered handler entries (`unlocked_ioctl`, `proc_write`, `store`, ...)
`ioctl_codes`	1289	decoded `_IOC` commands (dir/type/nr/size + arg struct + cmd symbol)
`handlers`	2914	handler functions (symbol + file:line)
`gates`	1298	capability / f_mode / field-check permission gates on handler paths

*_va columns hold a stable 64-bit hash(usr) (a symbol id, not an address; Linux is relocatable). The human location is in the companion name/file/ line columns with loc_kind in {symbol, site}. imagebase = 0.

Provenance

—Source: in-tree Linux kernel source (kg snapshot; exact git describe recorded in kb_meta).
—Coverage: 169 in-tree subtrees, 878 modules -- the whole source an x86_64 allmodconfig build compiles (84% of source .c files; the uncompiled remainder is other-architecture platform code). A second build for arm64 adds only 1 ioctl module and no new command codes.
—Determinism: the structural tables are content-hash byte-identical across two independent rebuilds (provenance timestamps excluded).
—Extraction: libclang over the kernel source (registrations, sinks, gates, reachability) + a clang -E -dM _IOC command-code resolver. Resolution rate 80% (1289 of 1614 switch-case symbols; the remainder are dominated by legacy non-_IOC numeric command constants that carry no decodable structure).

Important caveats (read before using)

—`user_reachable` is an UPPER BOUND, not a proof of unprivileged reach: it means "no hard init-namespace capability gate on the handler path." Precise node DAC (device-node mode/owner via udev/devtmpfs) is resolved only for a curated subset; a user_reachable=true row may still be gated by a root/hardware-only device node.
—Registration-type coverage: handlers registered via file_operations/ proc_ops/block_device_operations/sysfs attrs are captured. NOT yet captured: ops-table dispatch (DRM/V4L2/ALSA route per-command handlers through tables such as drm_ioctl_desc/v4l2_ioctl_ops, so for those subsystems only the fops-level dispatcher is recovered, not the per-command surface), tty line disciplines (tty_ldisc_ops), the core blkdev_ioctl switch, and netlink.
—Static analysis only; no runtime confirmation.

Companion

Schema-compatible sibling: the Windows IOCTL Census (huggingface.co/datasets/mjbommar/ioctl-census). See the paper Toward a Linux IOCTL Census for method, validation, and the cross-OS comparison.

License

CC-BY-4.0 (data). The census tooling is released separately under the project's source license.