Messages in this thread |  | | | Date | Mon, 29 Nov 2010 23:31:50 +0000 | | From | Alan Cox <> | | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
> > /* Some debugging symbols have no name. Ignore them. */ > > - if (!iter->name[0]) > > + if (!iter->name[0] || !capable(CAP_SYS_ADMIN)) > > return 0;
This is hardcoding file permission policy into the kernel in a way the user cannot change - its bogus in the extreme. Use file permissions that way saner people can chmod them as they like. Indeed quite a few people *already* chmod chunks of /proc.
It also means that things like SELinux and Tomoyo can be used to manage security on it in clever ways - something that using a capability completely buggers up.
Alan
|  |