* /proc/net/ip_conntrack permissions
@ 2004-06-02 2:13 Patrick McHardy
2004-06-02 5:17 ` Willy Tarreau
0 siblings, 1 reply; 2+ messages in thread
From: Patrick McHardy @ 2004-06-02 2:13 UTC (permalink / raw)
To: Netfilter Development Mailinglist
I've added a patch to change /proc/net/ip_conntrack permissions
to 0440. It contains privileged information and shouldn't be
world readable. I was just wondering why this hasn't been done
before, does anyone know a good reason not to change it ?
Regards
Patrick
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: /proc/net/ip_conntrack permissions
2004-06-02 2:13 /proc/net/ip_conntrack permissions Patrick McHardy
@ 2004-06-02 5:17 ` Willy Tarreau
0 siblings, 0 replies; 2+ messages in thread
From: Willy Tarreau @ 2004-06-02 5:17 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Netfilter Development Mailinglist
Hi Patrick,
On Wed, Jun 02, 2004 at 04:13:45AM +0200, Patrick McHardy wrote:
> I've added a patch to change /proc/net/ip_conntrack permissions
> to 0440. It contains privileged information and shouldn't be
> world readable. I was just wondering why this hasn't been done
> before, does anyone know a good reason not to change it ?
Strange, but I too think it should be restricted, since it's a source of
easy DoS : "while true; do wc -l /p/n/ip_ct ; done" :-/
Regards,
Willy
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-06-02 5:17 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-06-02 2:13 /proc/net/ip_conntrack permissions Patrick McHardy
2004-06-02 5:17 ` Willy Tarreau
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.