Re: [PATCH] kernel: make /proc/kallsyms mode 400 to reduce ease of attacking

["H. Peter Anvin" <hpa@zytor.com>]

On 11/25/2010 11:38 PM, Ingo Molnar wrote:
> 
> Yeah, restricting information is always a double edged sword - and by locking down 
> we are implicitly assuming that the number of people trying to do harm is larger 
> than the number of people trying to help. It is probably true though - and the 
> damage they can inflict is becoming more and more serious (financially, legally and 
> socially - and, in some cases, physically) with every year of humanity moving their 
> lives to the 'net.
> 
> So yes, the time has probably come to lock up "potentially harmful" information from 
> the default unprivileged user on Linux - at least from a default kernel policies 
> POV.
> 

The setting of these policies needs to be figured out sensibly.

One of my great complaints about several Linux distributions is that
they keep forcing log files to be readable only by root, even though
they do put the adm group in their default group file -- the adm group
is traditionally the group allowed to read log files.

It is a *good* thing for a *restricted set* of users to have *readonly*
access to this kind of information -- i.e., a group.  It is *not* a good
thing for system security or reliability to force the administrator to
assert root privileges to merely monitor information.

	-hpa