Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
FS#59613 - [linux-headers] Restrict access to System.map/vmlinux
Attached to Project:
Arch Linux
Opened by Tommy Schmitt (spinka) - Saturday, 11 August 2018, 10:44 GMT
Last edited by Eli Schwartz (eschwartz) - Sunday, 12 August 2018, 05:34 GMT
Opened by Tommy Schmitt (spinka) - Saturday, 11 August 2018, 10:44 GMT
Last edited by Eli Schwartz (eschwartz) - Sunday, 12 August 2018, 05:34 GMT
|
DetailsDescription:
After recent changes in linux package PKGBUILD, the 'System.map'[0] file is reintroduced in '/usr/lib/modules/<kernel_version/build/System.map'. Access to this file may be sensitive for security and is restricted to '400' on Ubuntu/Debian systems[1]. Arch can do the same thing and use 'chmod 400 System.map' in PKGBUILD. Similar thing may be done with 'vmlinux' kernel image which is currently available in two places: (1) /boot/vmlinuz-linux (2) /usr/lib/modules/<kernel_version/build/vmlinux I'm not sure what the purpose of (2) is. You may consider removing it or harden access to it as described above. [0] https://en.wikipedia.org/wiki/System.map [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615029 |
This task depends upon
Closed by Eli Schwartz (eschwartz)
Sunday, 12 August 2018, 05:34 GMT
Reason for closing: Not a bug
Additional comments about closing: This is completely junk logic, we are not going to make every file on the OS readable only by root because "principle of least privileges" and "Attacker don't have to bother with finding package files over the net"
Sunday, 12 August 2018, 05:34 GMT
Reason for closing: Not a bug
Additional comments about closing: This is completely junk logic, we are not going to make every file on the OS readable only by root because "principle of least privileges" and "Attacker don't have to bother with finding package files over the net"
[0] https://bugs.archlinux.org/task/25247
[1] http://dirac.org/linux/system.map/
What is to stop someone using a reproducible build to generate System.map? KASLR randomizes the base at boot time.
I am not against removing System.map as redundant but I do not see it as providing any security benefits.
Yes generic distro files can be downloaded by anyone from mirror thus I didn't marked this as highly important.
There are two things however:
1. Attacker don't have to bother with finding package files over the net as relevant files are stored in host available for anyone :)
2. It hurts everyone building their custom kernel using Arch Linux template who doesn't realise there are sensitive files stored by default.
Can you provide proof of concept code for instance that can extract this information and match it to a running kernel?
Edit:
spelling not instead of nto
Again, I agree this doesn't present real security threat for users but I thought it's good to stick with the 'least privilege' principle.