Re: [PATCH v3] sysctl: control functionality of /proc/pid/mem

[Vasiliy Kulikov <segoon@openwall.com>]

(cc'ed kernel-hardening)

On Mon, Jan 23, 2012 at 13:21 -0800, Kees Cook wrote:
> 
> Add the "proc_pid_mem" sysctl to control whether or not /proc/pid/mem is
> allowed to work: 0: disabled, 1: read only, 2: read/write (default).
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
...
> index f487f25..6fd4bc0 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -103,6 +103,7 @@ extern int percpu_pagelist_fraction;
>  extern int compat_log;
>  extern int latencytop_enabled;
>  extern int sysctl_nr_open_min, sysctl_nr_open_max;
> +extern int sysctl_proc_pid_mem;
>  #ifndef CONFIG_MMU
>  extern int sysctl_nr_trim_pages;
>  #endif
> @@ -1004,6 +1005,15 @@ static struct ctl_table kern_table[] = {
>  		.proc_handler	= proc_dointvec,
>  	},
>  #endif
> +	{
> +		.procname	= "proc_pid_mem",
> +		.data		= &sysctl_proc_pid_mem,
> +		.maxlen		= sizeof(int),
> +		.mode		= 0644,
> +		.proc_handler	= proc_dointvec_minmax,
> +		.extra1		= &zero,
> +		.extra2		= &two,
> +	},

While I fully agree that we should step by step opt out all deprecated and
legacy features, which are not widely used nowadays and are probably
dangerous from the security POV, but we should define a standart way
of doing it.  E.g. moving all such stuff to some sysctl group, not bloating
kernel.*.  Probably sysctl dir kernel.legacy.*?  Then this sysctl would be
kernel.legacy.proc_pid_mem.

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments