Messages in this thread | | | Date | Fri, 26 Nov 2010 08:38:34 +0100 | From | Ingo Molnar <> | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
* Pavel Machek <pavel@ucw.cz> wrote:
> Hi! > > > > (2) Most of the arguments about introducing "uncertainty" into the > > > hacking process are specious as well. [...] > > > > It is only specious if you ignore the arguments i made in the previous > > discussion. One argument i made was: > > Well, but it has downsides, too. > > If I know school server is vulnerable, I can get admin to fix it... if > I can see dmesg without being root, I can help with problems. I have > done both before...
Yeah, restricting information is always a double edged sword - and by locking down we are implicitly assuming that the number of people trying to do harm is larger than the number of people trying to help. It is probably true though - and the damage they can inflict is becoming more and more serious (financially, legally and socially - and, in some cases, physically) with every year of humanity moving their lives to the 'net.
So yes, the time has probably come to lock up "potentially harmful" information from the default unprivileged user on Linux - at least from a default kernel policies POV.
Thanks,
Ingo
| |