Messages in this thread | | | Date | Wed, 22 Dec 2010 14:03:49 +0100 | From | Ingo Molnar <> | Subject | Re: [PATCH v4] kptr_restrict for hiding kernel pointers |
| |
* Dan Rosenberg <drosenberg@vsecurity.com> wrote:
> +kptr_restrict: > + > +This toggle indicates whether restrictions are placed on > +exposing kernel addresses via /proc and other interfaces. When > +kptr_restrict is set to (0), the default, there are no > +restrictions. When kptr_restrict is set to (1), kernel pointers > +printed using the %pK format specifier will be replaced with 0's > +unless the user has CAP_SYSLOG. When kptr_restrict is set to > +(2), kernel pointers printed using %pK will be replaced with 0's > +regardless of privileges.
Hm, why is it off by default? Is there some user-space regression that is caused by this?
We really want good security measures to be active by default (and to work by default) - they are not worth much if they are not.
Thanks,
Ingo
| |