Date: Fri, 26 Nov 2010 08:51:58 +0100
From: Ingo Molnar <mingo@elte.hu>
To: Kees Cook <kees.cook@canonical.com>
Cc: Kyle McMartin <kyle@mcmartin.ca>, Marcus Meissner <meissner@suse.de>,
        torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
        tj@kernel.org, akpm@osdl.org, hpa@zytor.com, w@1wt.eu,
        alan@lxorguk.ukuu.org.uk, Andrew Morton <akpm@linux-foundation.org>
Subject: Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of
 attacking
Message-ID: <20101126075158.GE19589@elte.hu>
References: <20101116104600.GA24015@suse.de>
 <20101117050759.GE22651@bombadil.infradead.org>
 <20101118074804.GC32621@elte.hu>
 <20101120031820.GC4617@outflux.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20101120031820.GC4617@outflux.net>
User-Agent: Mutt/1.5.20 (2009-08-17)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1611
Lines: 42


* Kees Cook <kees.cook@canonical.com> wrote:

> On Thu, Nov 18, 2010 at 08:48:04AM +0100, Ingo Molnar wrote:
> > Agreed. A few other kernel address things that should be hidden are:
> > [snip]
> 
> For reference, here's what GRKERNSEC_HIDESYM looks like in grsecurity.
> It's quite a sledgehammer, but it does help to point out at least the
> minimum number of things that need fixing.

Yeah, it's a somewhat disgusting patch - but it also looks useful.

It would be more palatable for upstream if it was:

 - split up

 - if all those GRKERNSEC_HIDESYM #ifdefs were removed, either by making the 
   grsecurity defaults the default behavior, or by intelligently hiding it behinds 
   wrappers.

I'd suggest a single CONFIG_LEGACY_SYMBOLS=y config option for this, but only used 
to show those symbols that are absolutely needed for compatibility - like 
/proc/kallsyms. (Newer distros could disable this option and the kernel could 
eventually default to it being disabled as well.)

Also, while changing hexa output to symbolic output is fine, changing the oops 
output is borderline - that is an absolutely useful piece of information that helps 
us in decoding crashes. So i'd suggest to split that into a super-paranoid option or 
so.

Anyway, after a split-up we'll see how good the individual bits are - it's a bit of 
a mixed bag right now.

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/