Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Nov 2010 18:54:52 -0500
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel address leaks

On Mon, 22 Nov 2010 18:01:20 -0500, Dan Rosenberg wrote:
> -It may or may not be acceptable to replace the addresses with 0's
> based on privilege level.

I don't see why it should be considered unacceptable to require
CAP_NET_ADMIN to be able to debug these low-level interfaces. In what
scenario would someone attempting to do so not have the ability to
elevate privileges on the system they're working on?  Better yet, how
is requiring elevated privs actually a real problem for this use case?
Your patches don't actually prevent debugging, they just require the
user/debugger to get authorization to do so.  Tell the kernel devs
that they need to explain why this is a real problem, and that their
habitual "no" is not acceptable.  You're doing great, thankless work.
Keep on fighting the good fight, and thank you.

Oh, and if you get CVEs assigned, that kind of forces them to fix the
problem, right?

Best wishes,
Mike

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.