[lkml]   [2010]   [Nov]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
> >  	/* Some debugging symbols have no name.  Ignore them. */
> > - if (!iter->name[0])
> > + if (!iter->name[0] || !capable(CAP_SYS_ADMIN))
> > return 0;

This is hardcoding file permission policy into the kernel in a way the
user cannot change - its bogus in the extreme. Use file permissions that
way saner people can chmod them as they like. Indeed quite a few people
*already* chmod chunks of /proc.

It also means that things like SELinux and Tomoyo can be used to manage
security on it in clever ways - something that using a capability
completely buggers up.


 \ /
  Last update: 2010-11-30 00:35    [W:0.055 / U:4.808 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site