[lkml]   [2010]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
    On 11/25/2010 11:38 PM, Ingo Molnar wrote:
    > Yeah, restricting information is always a double edged sword - and by locking down
    > we are implicitly assuming that the number of people trying to do harm is larger
    > than the number of people trying to help. It is probably true though - and the
    > damage they can inflict is becoming more and more serious (financially, legally and
    > socially - and, in some cases, physically) with every year of humanity moving their
    > lives to the 'net.
    > So yes, the time has probably come to lock up "potentially harmful" information from
    > the default unprivileged user on Linux - at least from a default kernel policies
    > POV.

    The setting of these policies needs to be figured out sensibly.

    One of my great complaints about several Linux distributions is that
    they keep forcing log files to be readable only by root, even though
    they do put the adm group in their default group file -- the adm group
    is traditionally the group allowed to read log files.

    It is a *good* thing for a *restricted set* of users to have *readonly*
    access to this kind of information -- i.e., a group. It is *not* a good
    thing for system security or reliability to force the administrator to
    assert root privileges to merely monitor information.


     \ /
      Last update: 2010-11-29 20:07    [W:0.021 / U:7.128 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site