Messages in this thread | | | Subject | Re: [kernel-hardening] Re: [RFC PATCH 2/2] mm: restrict access to /proc/slabinfo | From | Dave Hansen <> | Date | Wed, 14 Sep 2011 11:24:40 -0700 |
| |
On Wed, 2011-09-14 at 19:42 +0400, Vasiliy Kulikov wrote: > > In other words, I dunno. If we do this in the kernel, can we at least > > do something like CONFIG_INSECURE to both track these kinds of things > > and make it easy to get them out of a developer's way? > > What do you think about adding your user to the slabinfo's group or > chmod it - quite the opposite Ubuntu currently does? I think it is more > generic (e.g. you may chmod 0444 to allow all users to get debug > information or just 0440 and chgrp admin to allow only trusted users to > do it) and your local policy doesn't touch the kernel.
That obviously _works_. I'd be happy to ack your patch. As I said, it's pretty minimally painful, even to folks who care about slabinfo like me.
-- Dave
| |