linux-kernel - Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101126073834.GC19589@elte.hu>
Date:	Fri, 26 Nov 2010 08:38:34 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Pavel Machek <pavel@....cz>
Cc:	Kyle Moffett <kyle@...fetthome.net>,
	Marcus Meissner <meissner@...e.de>,
	torvalds@...ux-foundation.org, linux-kernel@...r.kernel.org,
	tj@...nel.org, akpm@...l.org, hpa@...or.com, w@....eu,
	alan@...rguk.ukuu.org.uk
Subject: Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of
 attacking

* Pavel Machek <pavel@....cz> wrote:

> Hi!
> 
> > >   (2) Most of the arguments about introducing "uncertainty" into the
> > > hacking process are specious as well. [...]
> > 
> > It is only specious if you ignore the arguments i made in the previous
> > discussion. One argument i made was:
> 
> Well, but it has downsides, too.
> 
> If I know school server is vulnerable, I can get admin to fix it... if
> I can see dmesg without being root, I can help with problems. I have
> done both before...

Yeah, restricting information is always a double edged sword - and by locking down 
we are implicitly assuming that the number of people trying to do harm is larger 
than the number of people trying to help. It is probably true though - and the 
damage they can inflict is becoming more and more serious (financially, legally and 
socially - and, in some cases, physically) with every year of humanity moving their 
lives to the 'net.

So yes, the time has probably come to lock up "potentially harmful" information from 
the default unprivileged user on Linux - at least from a default kernel policies 
POV.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/