lkml.org 
[lkml]   [1999]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectipchains: /proc/net/ip_fw* permission change

I think it was in one of the pre6-ac patches (and now in pre7) that the
permission on /proc/net/ip_fw* was changed so that only root can read
it.

I searched for ip_fwchains + permission | security in the kernel
archive, but I didn't find anything. So, is there another place where
such a discussion would have happened, or is there an obvious reason why
people shouldn't be allowed to see how many packets have been processed
by ipchains?

I'm using a small program (wmnet) to display network statistics. For
2.1 (and 2.2), it is able to use either the ipchains stuff or
/proc/net/dev to get it's information. Unfortunately, the ip_fwchains
is no longer user readable, and /proc/net/dev always shows 0 for eth0's
receive and send byte counts (at least with the eepro100 driver).

Since 2.0.x has world-readable ipfwadm rules, without any security
issues, isn't it more of a security problem if you have to make all your
tools suid in order to get accounting information, or having to log in
as root every time you want to check status?

regards,
Val

PS. I'm not a member of this list.



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:49    [W:0.402 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site