Date: Fri, 26 Nov 2010 08:38:34 +0100
From: Ingo Molnar <mingo@elte.hu>
To: Pavel Machek <pavel@ucw.cz>
Cc: Kyle Moffett <kyle@moffetthome.net>, Marcus Meissner <meissner@suse.de>,
        torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
        tj@kernel.org, akpm@osdl.org, hpa@zytor.com, w@1wt.eu,
        alan@lxorguk.ukuu.org.uk
Subject: Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of
 attacking
Message-ID: <20101126073834.GC19589@elte.hu>
References: <20101116104600.GA24015@suse.de>
 <AANLkTi=F1vbwpOzyN9o0nuRtsEUTQx2j3==kLu9j7Ccb@mail.gmail.com>
 <20101118073126.GB32621@elte.hu>
 <20101123172437.GB8412@ucw.cz>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20101123172437.GB8412@ucw.cz>
User-Agent: Mutt/1.5.20 (2009-08-17)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1372
Lines: 36


* Pavel Machek <pavel@ucw.cz> wrote:

> Hi!
> 
> > >   (2) Most of the arguments about introducing "uncertainty" into the
> > > hacking process are specious as well. [...]
> > 
> > It is only specious if you ignore the arguments i made in the previous
> > discussion. One argument i made was:
> 
> Well, but it has downsides, too.
> 
> If I know school server is vulnerable, I can get admin to fix it... if
> I can see dmesg without being root, I can help with problems. I have
> done both before...

Yeah, restricting information is always a double edged sword - and by locking down 
we are implicitly assuming that the number of people trying to do harm is larger 
than the number of people trying to help. It is probably true though - and the 
damage they can inflict is becoming more and more serious (financially, legally and 
socially - and, in some cases, physically) with every year of humanity moving their 
lives to the 'net.

So yes, the time has probably come to lock up "potentially harmful" information from 
the default unprivileged user on Linux - at least from a default kernel policies 
POV.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/