From owner-freebsd-stable Wed Apr 15 09:53:47 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id JAA08222 for freebsd-stable-outgoing; Wed, 15 Apr 1998 09:53:47 -0700 (PDT) (envelope-from owner-freebsd-stable@FreeBSD.ORG) Received: from burka.rdy.com (dima@burka.rdy.com [205.149.163.30]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA08039; Wed, 15 Apr 1998 16:53:01 GMT (envelope-from dima@burka.rdy.com) Received: by burka.rdy.com id JAA00719; (8.8.8/RDY) Wed, 15 Apr 1998 09:52:58 -0700 (PDT) Message-Id: <199804151652.JAA00719@burka.rdy.com> Subject: Re: kernel permissions In-Reply-To: <19282.892651401@cloud.rain.com> from Bill Trost at "Apr 15, 98 07:43:21 am" To: trost@cloud.rain.com (Bill Trost) Date: Wed, 15 Apr 1998 09:52:58 -0700 (PDT) Cc: stable@FreeBSD.ORG, freebsd-security@FreeBSD.ORG X-Class: Fast Organization: HackerDome Reply-To: dima@best.net From: dima@best.net (Dima Ruban) X-Mailer: ELM [version 2.4ME+ PL38 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk Bill Trost writes: > Dima Ruban writes: > Is there a particular reason of kernel being installed with 555 root/wheel > permissions instead of 550 root/kmem ? > > If nobody has nothing against it - I'll commit the change. > > Is "/kernel" typically the first command in the pipe, or should it > appear in the middle? (-: > > Maybe I am missing something, but I see no reason for /kernel to have > the execute bits set. I doubt that the boot loader cares, and no one > wants to actually execute the kernel when it's already running. Sure, 440 permissions are fine with me. > As for the world read permissions: Removing the read permissions seems > like a gratuitious pseudo-security change. Is there any reason to > prevent users from reading the kernel? Presumably, /usr/src/sys is In some case I don't want my users to read a kernel name list. > readable anyhow, so a person could build their own kernel with the same > configuration, so they may as well just copy the running one. You do not always have /usr/src/sys on your machine. Especially on a production enviroment. > Or, in other words -- if you are going to make a change, 0444 seems like > the way to go. I'd say 0440 > -- dima To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message