Re: [PATCH] proc: avoid leaking eip, esp, or wchan to non-privileged processes (fwd)

Arjan van de Ven
2009-05-03T23:56:21Z

On Mon, 4 May 2009 09:27:29 +1000 (EST)
James Morris <jmorris@namei.org> wrote:

> This patch needs some review.

having just gotten back from another trip...

this patch looks relevant, but has a compatibility risk.... Personally
I think it'd be ok, but if things would break we do have some options
that are better than 'do nothing'.

One option to reduce the compatibility risk (as the expense of the
security angle) would be to mask the lower, say 4 to 8 bits of these
variables instead for non-ptrace-capable callers. Other obfuscation
options are obviously also possible.

>
> Having someone specifically responsible for maintaining kernel memory
> protection features would be of immense value. Any takers?

I suppose I could do that.... but would be nice to have a few folks.

--
Arjan van de Ven Intel Open Source Technology Centre
For development, discussion and tips for power savings,
visit http://www.lesswatts.org