[kernel-hardening] Re: [RFC 2/5 v4] procfs: add hidepid= and gid= mount options

James Morris
2011-06-20T23:19:34Z

On Mon, 20 Jun 2011, Vasiliy Kulikov wrote:

> > If they depend on specific permissions, yes.
>
> Could you please then clarify why does this patch changes
> pid_revalidate() behaviour:
>
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=99f895518368252ba862cc15ce4eb98ebbe1bec6
>
> It changes files permissions to allow userspace apps to quickly stat
> files, not looking into /proc/PID/status. So, uid and gid are explicit
> ABI. Breaking procfs uid/gid attributes would break these apps.
>

Right, but I'm saying that apps which depend on specific permissions are
broken, which is not the uid / gid attributes.

--
James Morris
<jmorris@namei.org>