lkml.org 
[lkml]   [2010]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
    Date

    ----- Original Message -----
    From: "Ingo Molnar" <mingo@elte.hu>
    To: "Willy Tarreau" <w@1wt.eu>
    Cc: "Marcus Meissner" <meissner@suse.de>; <security@kernel.org>;
    <mort@sgi.com>; "Peter Zijlstra" <a.p.zijlstra@chello.nl>;
    <fweisbec@gmail.com>; "H. Peter Anvin" <hpa@zytor.com>;
    <linux-kernel@vger.kernel.org>; <jason.wessel@windriver.com>;
    <tj@kernel.org>; <Andrew@zimbra8-e1.priv.proxad.net>; <"Morton
    <"@zimbra8-e1.priv.proxad.net>
    Sent: Sunday, November 07, 2010 10:08 AM
    Subject: Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to
    reduce ease of attacking


    >
    > * Ingo Molnar <mingo@elte.hu> wrote:
    >
    > > If your claim that 'kernel version is needed at many places' is true
    then why am i
    > > seeing this on a pretty general distro box bootup:
    > >
    > > [root@aldebaran ~]# uname -a
    > > Linux aldebaran 2.6.99-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7
    10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux
    > >
    > > ?
    > >
    > > Yes, some user-space might be unhappy if we set the version _back_ to
    say 2.4.0,
    > > but we could (as the patch below) fuzz up the version information from
    > > unprivileged attackers easily.
    >
    > Btw., with an 'exploit honeypot' and 'version fuzzing' the uname output
    would look
    > like this to an unprivileged user:
    >
    > $ uname -a
    > Linux aldebaran 2.6.99 x86_64 x86_64 x86_64 GNU/Linux
    >
    > [ we wouldnt want to include the date or the SHA1 of the kernel,
    obviously. ]
    >
    > And it would look like this to root:
    >
    > # uname -a
    > Linux aldebaran 2.6.37-tip-01574-g6ba54c9-dirty #1 SMP Sun Nov 7
    10:24:38 CET 2010 x86_64 x86_64 x86_64 GNU/Linux
    >
    > Ingo

    A bit late comment
    gesp@a7n8x-e:~$ strings /lib/modules/*/kernel/drivers/scsi/in2000.ko | grep
    2010
    Sep 16 2010
    gesp@a7n8x-e:~$ strings /lib/modules/*/kernel/drivers/char/nozomi.ko | grep
    2010
    Nozomi driver 2.1d (build date: Sep 16 2010 19:01:27)
    gesp@a7n8x-e:~$ uname -a
    Linux a7n8x-e 2.6.26-2-686 #1 SMP Thu Sep 16 19:35:51 UTC 2010 i686
    GNU/Linux

    Should it not be considered before to remove __DATE__ and __TIME__ from
    module code?
    That would have too the good effect that everyone that compile same code
    with same compiler get exactly same file.

    Gilles



    \
     
     \ /
      Last update: 2010-11-13 14:13    [W:0.023 / U:31.308 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site