Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755665Ab0K2SF0 (ORCPT ); Mon, 29 Nov 2010 13:05:26 -0500 Received: from mx2.mail.elte.hu ([157.181.151.9]:51122 "EHLO mx2.mail.elte.hu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755628Ab0K2SFY (ORCPT ); Mon, 29 Nov 2010 13:05:24 -0500 Date: Mon, 29 Nov 2010 19:04:29 +0100 From: Ingo Molnar To: Sarah Sharp Cc: Linus Torvalds , Marcus Meissner , linux-kernel@vger.kernel.org, tj@kernel.org, akpm@linux-foundation.org, hpa@zytor.com, w@1wt.eu, alan@lxorguk.ukuu.org.uk Subject: Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking Message-ID: <20101129180429.GB14046@elte.hu> References: <20101116104600.GA24015@suse.de> <20101119191906.GA31760@xanatos> <20101126074809.GD19589@elte.hu> <20101129163308.GA2383@xanatos> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20101129163308.GA2383@xanatos> User-Agent: Mutt/1.5.20 (2009-08-17) X-ELTE-SpamScore: -2.0 X-ELTE-SpamLevel: X-ELTE-SpamCheck: no X-ELTE-SpamVersion: ELTE 2.0 X-ELTE-SpamCheck-Details: score=-2.0 required=5.9 tests=BAYES_00 autolearn=no SpamAssassin version=3.2.5 -2.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1% [score: 0.0000] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1379 Lines: 38 * Sarah Sharp wrote: > On Fri, Nov 26, 2010 at 08:48:09AM +0100, Ingo Molnar wrote: > > > > * Linus Torvalds wrote: > > > > > On Fri, Nov 19, 2010 at 11:19 AM, Sarah Sharp > > > wrote: > > > > > > > > .config and dmesg are attached. ?The box is running klogd 1.5.5ubuntu3 > > > > (from Jaunty). ?Yes, I know that's old. ?I read the bit in the commit > > > > about changing the permissions of kallsyms after boot, but if I can't > > > > boot that doesn't help. ?Perhaps this can be made a configuration > > > > option? > > > > > > It's not worth a config option. > > > > > > If it actually breaks user-space, I think we should just revert it. > > > > Sarah, > > > > Does your system boot fine if we make /proc/kallsyms simply an empty file to > > unprivileged users? Something like the (untested ...) patch below. > > Yes, that works. The system boots as normal. `cat /proc/kallsyms` > returns an empty file, and `sudo cat /proc/kallsyms` does not. Great! Marcus, mind respinning your patch with that approach? Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/