public inbox for kernel-hardening@lists.openwall.com
 help / color / mirror / Atom feed
From: Solar Designer <solar@openwall.com>
To: kernel-hardening@lists.openwall.com
Cc: Pavel Labushev <p.labushev@gmail.com>
Subject: Re: [kernel-hardening] /proc/PID directory hiding (was: [owl-dev] segoon's status report - #1 of 15)
Date: Sun, 5 Jun 2011 01:03:15 +0400	[thread overview]
Message-ID: <20110604210315.GA6051@openwall.com> (raw)
In-Reply-To: <20110604202018.GA8019@shinshilla>

On Sun, Jun 05, 2011 at 12:20:47AM +0400, Vasiliy Kulikov wrote:
> On Sat, Jun 04, 2011 at 22:19 +0400, Solar Designer wrote:
> > As to probing for PIDs with syscalls such as kill(2), we may deal with
> > that as well
> 
> I'd not do this.  There are too many paths using pids, I don't think
> there is some universal way (read: a bottleneck) to filter all accesses.

Something like this is done for containers, but I agree with you.

> And the award is not too high to bother.

Yes, perhaps, and it'd be difficult to avoid timing leaks.

Anyhow, this would be a separate task.  Let's deal with the filesystems
first, and then proceed with other hardening measures already
implemented in patches and needing proper submission upstream.

Alexander

  reply	other threads:[~2011-06-04 21:03 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20110518150601.GA2921@albatros>
     [not found] ` <20110524023409.GC12486@openwall.com>
     [not found]   ` <20110524151246.GA3401@albatros>
     [not found]     ` <4DE139FE.8050808@gmail.com>
2011-06-04 18:19       ` [kernel-hardening] /proc/PID directory hiding (was: [owl-dev] segoon's status report - #1 of 15) Solar Designer
2011-06-04 20:20         ` Vasiliy Kulikov
2011-06-04 21:03           ` Solar Designer [this message]
2011-06-05  0:10           ` [kernel-hardening] /proc/PID directory hiding Pavel Labushev
2011-06-05  1:18             ` Pavel Labushev

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110604210315.GA6051@openwall.com \
    --to=solar@openwall.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=p.labushev@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox