Date: Mon, 22 Nov 2010 18:54:52 -0500 From: Michael Gilbert <michael.s.gilbert@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel address leaks On Mon, 22 Nov 2010 18:01:20 -0500, Dan Rosenberg wrote: > -It may or may not be acceptable to replace the addresses with 0's > based on privilege level. I don't see why it should be considered unacceptable to require CAP_NET_ADMIN to be able to debug these low-level interfaces. In what scenario would someone attempting to do so not have the ability to elevate privileges on the system they're working on? Better yet, how is requiring elevated privs actually a real problem for this use case? Your patches don't actually prevent debugging, they just require the user/debugger to get authorization to do so. Tell the kernel devs that they need to explain why this is a real problem, and that their habitual "no" is not acceptable. You're doing great, thankless work. Keep on fighting the good fight, and thank you. Oh, and if you get CVEs assigned, that kind of forces them to fix the problem, right? Best wishes, Mike
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.