lkml.org 
[lkml]   [2010]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

* Willy Tarreau <w@1wt.eu> wrote:

> On Thu, Nov 04, 2010 at 08:08:04PM +0100, Ingo Molnar wrote:
> >
> > * Marcus Meissner <meissner@suse.de> wrote:
> >
> > > > For example, on a Fedora testbox i have this version info:
> > > >
> > > > $ uname -r
> > > > 2.6.35.6-48.fc14.x86_64
> > > >
> > > > Any attacker can download that rpm from:
> > > >
> > > > http://download.fedora.redhat.com/pub/fedora/linux/updates/14/x86_64/kernel-2.6.35.6-48.fc14.x86_64.rpm
> > > >
> > > > And can extract the System.map from it, using rpm2cpio and cpio -i -d. That will
> > > > include all the symbol addresses - without the attacker having any access to the
> > > > System.map or /proc/kallsyms on this particular box.
> > > >
> > > > I.e. on distro kernel installations (which comprise the _vast_ majority of our
> > > > userbase) your patch brings little security benefits.
> > > >
> > > > What i suggested in later parts of my mail might provide more security: to
> > > > sandbox kernel version information from unprivileged user-space - if we decide
> > > > that we want to sandbox kernel version information ...
> > > >
> > > > That is a big if, because it takes a considerable amount of work. Would be worth
> > > > trying it - but feel-good non-solutions that do not bring much improvement to
> > > > the majority of users IMHO hinder such efforts.
> > >
> > > Hiding the OS version is really quite hard I think.
> >
> > Yes. Hard but it would be useful - especially if we start adding things like known
> > exploit honeypots. Forcing attackers to probe the kernel by actually running a
> > kernel exploit, and risking an alarm would be a very powerful security feature.
> >
> > Removing version info will upset some tools/libraries that rely on kernel
> > version information for quirks though.
>
> Quite honnestly, it's the worst idea I've ever read to protect the kernel. Kernel
> version is needed at many places, when building some code which relies on presence
> of syscall X or Y depending on a version, etc... [...]

Actually that's not true, since we have a kernel ABI, and since there's many
backports of newer kernel features into older kernels that it's generally not
needed nor meaningful to know the kernel version for syscalls.

Returning -ENOSYS is the general standard we use to communicate syscall
capabilities.

In fact using kernel version to switch around library functionality is a bug i'd
argue.

> [...] If our kernel is so buggy that we can only rely on its version to be kept
> secret, then we have already failed.

That mischaracterises my suggestion rather heavily - which makes me suspect that you
misunderstood it. Here's the relevant section of what i suggested here:

> > Hard but it would be useful - especially if we start adding things like known
> > exploit honeypots. Forcing attackers to probe the kernel by actually running a
> > kernel exploit, and risking an alarm would be a very powerful security feature.

An 'exploit honeypot' would be some small amount of 'detection' code for the
exploitable pattern of parameters (most attacks come via ioctls so we can add
detection for known holes without any performance hit), and the kernel would warn
the sysadmin that an exploit attempt has occured.

The point is to make it riskier to run exploits - not to 'hide version because we
are so buggy'. Unprivileged attackers wont be able to know whether a kernel is
unpatched and wont know whether trying an actual exploit triggers a silent alarm or
not.

I.e. i think the only true break-through in kernel security will be to add credible
and substantial 'strike back' functionality - to increase the risks of detection
(which necessiates the removal of the information whether a kernel is patched or
not).

As i said it's hard - but it would be a rather break-through security feature for
Linux. Not an 'arms race' thing where we just put obstruction in the road of
attackers - but some real, unavoidable risk not detectable by attackers - running on
most stock distro kernels. (so there would be a real economy of scale)

The kerneloops client could also collect exploit attempt stats.

Thanks,

Ingo


\
 
 \ /
  Last update: 2010-11-04 22:55    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site