procfs privacy: /proc/config.gz
PATCH 5/7 procfs privacy: /proc/config.gz
This patch changes the permissions of the procfs entry config.gz, thus, non-root users are restricted from accessing it.
It's also available at:
http://pearls.tuxedo-es.org/patches/security/proc-privacy-1_kernel_configs.c.patch
Signature · 2 lines
Lorenzo Hernández García-Hierro <[email protected]> [1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]
kernel/configs.c renamed from kernel/configs.c~proc-privacy-1 +1 -1
@@ -89,7 +89,7 @@ static int __init ikconfig_init(void)struct proc_dir_entry *entry;/* create the current config file */ - entry =create_proc_entry ("config.gz" ,S_IFREG |S_IRUGO , + entry =create_proc_entry ("config.gz" ,S_IFREG |S_IRUSR , &proc_root);if (!entry)return -ENOMEM ;
Quoted 2 lines · Lorenzo Hernández García-Hierro
This patch changes the permissions of the procfs entry config.gz, thus, non-root users are restricted from accessing it.
Why?
What is the security benefit of doing this ?
Signature · 3 lines
"Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it." - Brian W. Kernighan