lkml.org 
[lkml]   [2012]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2012.1] fs: symlink restrictions on sticky directories

* Kees Cook <keescook@chromium.org> wrote:

> @@ -1495,6 +1496,15 @@ static struct ctl_table fs_table[] = {
> #endif
> #endif
> {
> + .procname = "protected_sticky_symlinks",
> + .data = &protected_sticky_symlinks,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec_minmax,
> + .extra1 = &zero,
> + .extra2 = &one,
> + },

Small detail:

Might make sense to change the .mode to 0600, to make it harder
for unprivileged attack code to guess whether this protection
(and the resulting audit warning to the administrator) is
enabled on a system or not.

It can be probed, but only at the cost of generating a warning.

Likewise, distros should set /etc/sysctl.conf to 0600 as well,
for similar reasons.

Thanks,

Ingo


\
 
 \ /
  Last update: 2012-01-05 10:21    [W:1.021 / U:0.672 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site