[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20101122185452.cd6659f5.michael.s.gilbert@gmail.com>
Date: Mon, 22 Nov 2010 18:54:52 -0500
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel address leaks
On Mon, 22 Nov 2010 18:01:20 -0500, Dan Rosenberg wrote:
> -It may or may not be acceptable to replace the addresses with 0's
> based on privilege level.
I don't see why it should be considered unacceptable to require
CAP_NET_ADMIN to be able to debug these low-level interfaces. In what
scenario would someone attempting to do so not have the ability to
elevate privileges on the system they're working on? Better yet, how
is requiring elevated privs actually a real problem for this use case?
Your patches don't actually prevent debugging, they just require the
user/debugger to get authorization to do so. Tell the kernel devs
that they need to explain why this is a real problem, and that their
habitual "no" is not acceptable. You're doing great, thankless work.
Keep on fighting the good fight, and thank you.
Oh, and if you get CVEs assigned, that kind of forces them to fix the
problem, right?
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
