Messages in this thread | | | Date | Sun, 17 Jan 1999 12:22:42 -0700 | From | Valient Gough <> | Subject | ipchains: /proc/net/ip_fw* permission change |
| |
I think it was in one of the pre6-ac patches (and now in pre7) that the permission on /proc/net/ip_fw* was changed so that only root can read it.
I searched for ip_fwchains + permission | security in the kernel archive, but I didn't find anything. So, is there another place where such a discussion would have happened, or is there an obvious reason why people shouldn't be allowed to see how many packets have been processed by ipchains?
I'm using a small program (wmnet) to display network statistics. For 2.1 (and 2.2), it is able to use either the ipchains stuff or /proc/net/dev to get it's information. Unfortunately, the ip_fwchains is no longer user readable, and /proc/net/dev always shows 0 for eth0's receive and send byte counts (at least with the eepro100 driver).
Since 2.0.x has world-readable ipfwadm rules, without any security issues, isn't it more of a security problem if you have to make all your tools suid in order to get accounting information, or having to log in as root every time you want to check status?
regards, Val
PS. I'm not a member of this list.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |