lkml.org 
[lkml]   [2003]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: kernel ring buffer accessible by users
From
On Wed, Apr 23, 2003 at 12:56:03PM -0300, Werner Almesberger wrote:

Hello Werner,

> > I think the problem is that kernel messages should not contain private
> > information, like ISDN phone numbers. Why is that even in the kernel?

> How do you know what is sensitive information ? A kernel debug
> message may just say something like "bad message 47 65 68 65 69 6d",
> and the kernel has no idea that this is actually a password
> ("Geheim").

Exactly what I mean, thanks for pointing this out!

I'm afraid I can't remember a specific example, but I remember that
there actually happened something like that and those were things where
the kernel simply couldn't know that the info it gave was "secret".

Of course one could say "then let's just stop writing out anything in
the kernel buffer that COULD be sensitive", but I think this would
actually castrate the meaning of such a buffer.

Why exactly should an ordinary user have access to the kernel ring
buffer? I can't imagine anything that could be of any interest for him
or her. And there's stillt he possibility to tweak the permissions for
dmesg so that only a certain group (staff, operator, adm...) can execute
it, but then setuid root. That way, operators being non-root are also
happy.

Just because Solaris allows access, Linux doesn't have to, or has it?
And I think that in all those years the kernel output from Linux has
been growing immensly compared to that of Solaris.

Regards,
Julien

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:34    [W:0.050 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site