Messages in this thread | | | Date | Fri, 19 Nov 2010 18:40:34 -0800 | From | Kees Cook <> | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
On Fri, Nov 19, 2010 at 03:22:00PM -0800, Linus Torvalds wrote: > In this case, the upside just wasn't big enough to accept _any_ > breakage, especially since people and distributions can just do the > "chmod" themselves if they want to. There was a lot of discussion > whether the patch should even go in in the first place. So this time, > the "let's just revert it" was a very easy decision for me.
The downside is that /proc can be remounted multiple times for different containers, etc. Having to patch everything that mounts /proc to do the chmod seems much more painful that fixing a simple userspace bug in an old klog daemon.
(For example, rsyslogd handles this fine since it's root to open it, and even if it fails, it doesn't do the broken fclose().)
-Kees
-- Kees Cook Ubuntu Security Team
| |