lkml.org 
[lkml]   [2010]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
On Thu, Nov 04, 2010 at 11:35:26PM +0100, Willy Tarreau wrote:
> > The point is to make it riskier to run exploits - not to 'hide version because we
> > are so buggy'. Unprivileged attackers wont be able to know whether a kernel is
> > unpatched and wont know whether trying an actual exploit triggers a silent alarm or
> > not.
>
> In my opinion, hiding the distro-specific part of the version should not cause
> too much harm, but still I find this useless.

BTW, if you want to hide the kernel version for the 99% distro kernels,
there's a very simple way to do that : just don't bump EXTRAVERSION nor
the build date in official builds. Keep it the same for all the product's
life, and provide the real name in a /proc entry that is only readable by
root by default. This will solve your issue with the exact kernel version
revealing pointers/bugs without hurting compatibility with user space
tools.

That will not hide the hints I was talking about though (uptime, dir mod
time, ...) but it will provide you with a version unrelated to the bug
level.

Regards,
Willy



\
 
 \ /
  Last update: 2010-11-05 00:49    [W:0.099 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site