Re: [kernel-hardening] Re: [RFC PATCH 2/2] mm: restrict access to /proc/slabinfo

[Vasiliy Kulikov <segoon@openwall.com>]

Hello Pekka,

On Mon, Sep 19, 2011 at 17:30 +0300, Pekka Enberg wrote:
> > On Wed, Sep 14, 2011 at 12:27 -0700, Kees Cook wrote:
> >> On Sat, Sep 10, 2011 at 08:41:34PM +0400, Vasiliy Kulikov wrote:
> >> > Historically /proc/slabinfo has 0444 permissions and is accessible to
> >> > the world.  slabinfo contains rather private information related both to
> >> > the kernel and userspace tasks.  Depending on the situation, it might
> >> > reveal either private information per se or information useful to make
> >> > another targeted attack.  Some examples of what can be learned by
> >> > reading/watching for /proc/slabinfo entries:
> >> > ...
> >> > World readable slabinfo simplifies kernel developers' job of debugging
> >> > kernel bugs (e.g. memleaks), but I believe it does more harm than
> >> > benefits.  For most users 0444 slabinfo is an unreasonable attack vector.
> >> >
> >> > Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
> 
> On Sun, Sep 18, 2011 at 8:05 PM, Vasiliy Kulikov <segoon@openwall.com> wrote:
> >> Haven't had any mass complaints about the 0400 in Ubuntu (sorry Dave!), so
> >> I'm obviously for it.
> >>
> >> Reviewed-by: Kees Cook <kees@ubuntu.com>
> >
> > Looks like the members of the previous slabinfo discussion don't object
> > against the patch now and it got two other Reviewed-by responses.  Can
> > you merge it as-is or should I probably convince someone else?
> 
> We discussed this in March (google for 'Make /proc/slabinfo 0400')

Sure, I've read it and included the link in the patch description :)

> and
> concluded that it's not worth it doesn't really protect from anything

Closing only slabinfo doesn't add any significant protection against
kernel heap exploits per se, no objections here.  

But as said in the desciption, the reason for this patch is not protecting
against exploitation heap bugs.  It is a source of infoleaks of kernel
and userspace activity, which should be forbidden to non-root users.

> and causes harm to developers.

One note: only to _kernel_ developers.  It means it is a strictly
debugging feature, which shouldn't be enabled in the production systems.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>