Messages in this thread | | | Date | Fri, 5 Nov 2010 00:46:33 +0100 | From | Willy Tarreau <> | Subject | Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
On Thu, Nov 04, 2010 at 11:35:26PM +0100, Willy Tarreau wrote: > > The point is to make it riskier to run exploits - not to 'hide version because we > > are so buggy'. Unprivileged attackers wont be able to know whether a kernel is > > unpatched and wont know whether trying an actual exploit triggers a silent alarm or > > not. > > In my opinion, hiding the distro-specific part of the version should not cause > too much harm, but still I find this useless.
BTW, if you want to hide the kernel version for the 99% distro kernels, there's a very simple way to do that : just don't bump EXTRAVERSION nor the build date in official builds. Keep it the same for all the product's life, and provide the real name in a /proc entry that is only readable by root by default. This will solve your issue with the exact kernel version revealing pointers/bugs without hurting compatibility with user space tools.
That will not hide the hints I was talking about though (uptime, dir mod time, ...) but it will provide you with a version unrelated to the bug level.
Regards, Willy
| |