Messages in this thread | | | Date | Mon, 29 Nov 2010 14:21:33 -0500 | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking | From | Eric Paris <> |
| |
On Mon, Nov 29, 2010 at 2:05 PM, H. Peter Anvin <hpa@zytor.com> wrote: > On 11/29/2010 10:04 AM, Ingo Molnar wrote: >> >> * Sarah Sharp <sarah.a.sharp@linux.intel.com> wrote: >> >>> On Fri, Nov 26, 2010 at 08:48:09AM +0100, Ingo Molnar wrote:
>>>> Sarah, >>>> >>>> Does your system boot fine if we make /proc/kallsyms simply an empty file to >>>> unprivileged users? Something like the (untested ...) patch below. >>> >>> Yes, that works. The system boots as normal. `cat /proc/kallsyms` >>> returns an empty file, and `sudo cat /proc/kallsyms` does not. >> >> Great! Marcus, mind respinning your patch with that approach? >> > > Can we please not use CAP_SYS_ADMIN for this? Relying on CAP_SYS_ADMIN > is worse than anything else -- it is a fixed policy hardcoded in the > kernel, with no ability for the system owner to delegate the policy > outward, e.g. by adding group read permission and/or chgrp the file. > > Delegating CAP_SYS_ADMIN, of course, otherwise known as "everything", is > worse than anything...
Serge just proposed a new CAP_SYSLOG
http://lwn.net/Articles/378472/
Which could probably still be renamed and used to cover this access as well.... -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |