summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarcus Meissner <meissner@suse.de>2010-11-16 11:46:03 +0100
committerLinus Torvalds <torvalds@linux-foundation.org>2010-11-16 19:06:01 -0800
commit59365d136d205cc20fe666ca7f89b1c5001b0d5a (patch)
treed2496dd73d699de6987599e5c4651ea5ba7a4857
parent1d6636502b23a964f4e5aac5237d1bbb76a9f912 (diff)
kernel: make /proc/kallsyms mode 400 to reduce ease of attacking
Making /proc/kallsyms readable only for root by default makes it slightly harder for attackers to write generic kernel exploits by removing one source of knowledge where things are in the kernel. This is the second submit, discussion happened on this on first submit and mostly concerned that this is just one hole of the sieve ... but one of the bigger ones. Changing the permissions of at least System.map and vmlinux is also required to fix the same set, but a packaging issue. Target of this starter patch and follow ups is removing any kind of kernel space address information leak from the kernel. [ Side note: the default of root-only reading is the "safe" value, and it's easy enough to then override at any time after boot. The /proc filesystem allows root to change the permissions with a regular chmod, so you can "revert" this at run-time by simply doing chmod og+r /proc/kallsyms as root if you really want regular users to see the kernel symbols. It does help some tools like "perf" figure them out without any setup, so it may well make sense in some situations. - Linus ] Signed-off-by: Marcus Meissner <meissner@suse.de> Acked-by: Tejun Heo <tj@kernel.org> Acked-by: Eugene Teo <eugeneteo@kernel.org> Reviewed-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--kernel/kallsyms.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 6f6d091b5757..a8db2570f99a 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -546,7 +546,7 @@ static const struct file_operations kallsyms_operations = {
static int __init kallsyms_init(void)
{
- proc_create("kallsyms", 0444, NULL, &kallsyms_operations);
+ proc_create("kallsyms", 0400, NULL, &kallsyms_operations);
return 0;
}
device_initcall(kallsyms_init);