• Vasiliy Kulikov's avatar
    mm: restrict access to slab files under procfs and sysfs · ab067e99
    Vasiliy Kulikov authored
    Historically /proc/slabinfo and files under /sys/kernel/slab/* have
    world read permissions and are accessible to the world.  slabinfo
    contains rather private information related both to the kernel and
    userspace tasks.  Depending on the situation, it might reveal either
    private information per se or information useful to make another
    targeted attack.  Some examples of what can be learned by
    reading/watching for /proc/slabinfo entries:
    
    1) dentry (and different *inode*) number might reveal other processes fs
    activity.  The number of dentry "active objects" doesn't strictly show
    file count opened/touched by a process, however, there is a good
    correlation between them.  The patch "proc: force dcache drop on
    unauthorized access" relies on the privacy of dentry count.
    
    2) different inode entries might reveal the same information as (1), but
    these are more fine granted counters.  If a filesystem is mounted in a
    private mount point (or even a private namesp...
    ab067e99
slab.c 119 KB