Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease ofattacking

[Alan Cox]

> >  	/* Some debugging symbols have no name.  Ignore them. */
> > -	if (!iter->name[0])
> > +	if (!iter->name[0] || !capable(CAP_SYS_ADMIN))
> >  		return 0;

This is hardcoding file permission policy into the kernel in a way the
user cannot change - its bogus in the extreme. Use file permissions that
way saner people can chmod them as they like. Indeed quite a few people
*already* chmod chunks of /proc.

It also means that things like SELinux and Tomoyo can be used to manage
security on it in clever ways - something that using a capability
completely buggers up.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/