Re: [Security] [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

[Willy Tarreau <w@1wt.eu>]

On Sun, Nov 07, 2010 at 01:12:35PM +0100, Ingo Molnar wrote:
> 
> * Willy Tarreau <w@1wt.eu> wrote:
> 
> > [...]
> >
> > It's precisely because you're making a special case of the security bug that you 
> > want to hide bugs from user-space by cheating on version.
> 
> You claimed this for the second time and i'm denying it for the second time.
> 
> The goal of fuzzing the version inforation is _not_ to 'hide bugs from user-space by 
> cheating on version'. The goal is to introduce uncertainty to attackers, so that a 
> honeypot silent alarm can warn the admin.

My interpretation of this mechanism is what I explained above. "Introducing
uncertainty" means hiding a version so that the attacker doesn't precisely
know which one it is and has to send a few probes to guess it. That's not
much different than trying to fire the exploit itself. When you run a
null-deref kernel exploit, better be sure of what you're doing, otherwise
the admin will shortly be aware of it too.

You could as well consider that launching some commands is suspicious
(eg: uname). You'll obviously get a lot of false-positive alarms from
all autoconf scripts run in local, but this gives an idea. Anyway, when
local users have their time (eg: students), it's still easy to guess the
version.

> Why are you putting words in my mouth?

I'm not putting anything in your mouth Ingo :-)

Willy