From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail6.bemta7.messagelabs.com (mail6.bemta7.messagelabs.com [216.82.255.55]) by kanga.kvack.org (Postfix) with ESMTP id DA8AF9000BD for ; Mon, 19 Sep 2011 15:20:18 -0400 (EDT) Received: by gwm11 with SMTP id 11so6355373gwm.30 for ; Mon, 19 Sep 2011 12:20:17 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <20110919185518.GA5563@albatros> References: <20110919144657.GA5928@albatros> <20110919155718.GB16272@albatros> <20110919161837.GA2232@albatros> <20110919173539.GA3751@albatros> <20110919175856.GA4282@albatros> <20110919185518.GA5563@albatros> Date: Mon, 19 Sep 2011 22:20:16 +0300 Message-ID: Subject: Re: [kernel-hardening] Re: [RFC PATCH 2/2] mm: restrict access to /proc/slabinfo From: Pekka Enberg Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Sender: owner-linux-mm@kvack.org List-ID: To: Vasiliy Kulikov Cc: Andrew Morton , kernel-hardening@lists.openwall.com, Kees Cook , Cyrill Gorcunov , Al Viro , Christoph Lameter , Matt Mackall , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Dan Rosenberg , Theodore Tso , Alan Cox , Jesper Juhl , Linus Torvalds On Mon, Sep 19, 2011 at 9:55 PM, Vasiliy Kulikov wrot= e: > Oh, we also have perf... =A0Given these are separate interfaces, I think > slab oriented restriction makes more sense. > > So, now we have: > > /proc/slabinfo > /sys/kernel/slab > /proc/meminfo > 'perf kmem' - not sure what specific files should be guarded I don't think you can close down 'perf kmem' per se. You need to make sure the attacker is not able to use perf tracing (of which 'perf kmem' is a subset). Pekka -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: email@kvack.org