Messages in this thread | | | Date | Thu, 4 Nov 2010 19:38:57 -0700 | From | Frank Rowand <> | Subject | Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
On 11/04/10 05:29, Marcus Meissner wrote: > On Thu, Nov 04, 2010 at 12:46:48PM +0100, Ingo Molnar wrote: >> >> * Marcus Meissner <meissner@suse.de> wrote: >> >>> Hi, >>> >>> Making /proc/kallsyms readable only for root makes it harder for attackers to >>> write generic kernel exploits by removing one source of knowledge where things are >>> in the kernel.
< snip >
>> So what does a distribution like Suse expect from this change alone? Those have >> public packages in rpms which can be downloaded by anyone, so it makes little sense >> to hide it - unless _all_ version information is hidden. > > It is the first patch, mostly an acceptance test balloon. > > There are several other files handing information out, but kallsyms has > it all very nice and ready. > > (timer_list, /proc/*/stat*, sl?binfo ) > >> So i'd like to see a _full_ version info sandboxing patch that thinks through all >> the angles and restricts uname -r kernel version info as well, and makes dmesg >> unaccessible to users - and closes a few other information holes as well that give >> away the exact kernel version - _that_ together will make it hard to blindly attack >> a very specific kernel version. > > I am personally thinking of a "small steps" philosophy, one step after the other.
< snip >
The idea of trying to hide the kernel version is absurd. The number of different places that can provide a precise fingerprint of a kernel version, or a small range of possible kernel versions is immense. Closing all of those places makes use and administration of a system more difficult, and encourages frequent use of su.
Dumb examples of version clues (beyond the obvious simple ones):
$ gcc -v Target: x86_64-redhat-linux gcc version 4.4.4 20100630 (Red Hat 4.4.4-10) (GCC)
$ rpm -qi gcc Release : 10.fc13 Build Date: Wed Jun 30 02:54:10 2010
$ rpm -qi kernel Version : 2.6.33.3 Vendor: Fedora Project Release : 85.fc13 Build Date: Thu May 6 11:35:36 2010
$ ls -l /lib64 $ ls -l /boot $ lsmod
-Frank
| |