Messages in this thread | ![/](/images/icornerl.gif) | | Date | Sun, 7 Nov 2010 13:37:46 +0100 | From | Ingo Molnar <> | Subject | Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking |
| |
* Willy Tarreau <w@1wt.eu> wrote:
> > All must be closed down for unprivileged user-space, for this to be effective, > > obviously. > > This would only be effective against finding a precise version. [...]
I'm glad that you agree with my point.
> [...] There's no need for that, what you want is to hide kernel pointers, [...]
That's a new claim from you - and when put like that it's wrong too: if the goal is to introduce risk of detection to attackers (which i suggested to be an efficient security measure), then hiding/fuzzing version information is an essential/needed piece of such a measure, not something for which there is 'no need'.
Hiding the address of kernel data/code structures is another piece of such a larger goal. Btw., as i argued it to Marcus already, hiding /proc/kallsyms will not hide these addresses on the vast majority of Linux systems, and that the patch would only cure the symptom, not the cause:
| | But without actually declaring and achieving that sandboxing goal this security | measure is just a feel-good thing really [...] |
Anyway, i wasnt particularly successful in conveying my past arguments to you so i'd rather leave the discussion at this point. You made your points and i made my points as well.
Thanks,
Ingo
| ![\](/images/icornerr.gif) |