Hi,
The file "/proc/sys/kernel/randomize_va_space" has write permission for user as below: [root@shagun ~]# ls -lrtZ /proc/sys/kernel/randomize_va_space rw-r--r--. root root system_u:object_r:proc_security_t:s0 /proc/sys/kernel/randomize_va_space
If we want to change this permission to read only permission for the user. Is it possible?
And i found the code also:
kernel/sysctl.c @@ -1130,7 +1130,11 @@ static struct ctl_table kern_table[] = { .procname = "randomize_va_space", .data = &randomize_va_space, .maxlen = sizeof(int), +#ifdef CONFIG_ASLR_SYSCTL_READ_ONLY + .mode = 0444, +#else .mode = 0644, +#endif
Can we make it as 0444, currently randomize_va_space is 644?
Any changes to the kernel should be requested through https://clicktime.symantec.com/3KpmXJbD9xEqbGPHpBNCtpd7Vc?u=https%3A%2F%2Fbu... for RHEL7's kernel package.
Why do you want root to not be able to write to that sysctl? Do you not want it to be able to be modified?
Because While running dASLR tool, "randomize_va_space unconfigurable" test in "Kernel Check" is FAILED.
As per support for dASLR tool, "randomize_va_space_unconfigurable" fail means that "/proc/sys/kernel/randomize_va_space" has write permission.
Regards, Shagun
On Fri, Jun 28, 2019 at 10:25:52AM +0000, Maheshwari, Shagun wrote:
Because While running dASLR tool, "randomize_va_space unconfigurable" test in "Kernel Check" is FAILED.
As per support for dASLR tool, "randomize_va_space_unconfigurable" fail means that "/proc/sys/kernel/randomize_va_space" has write permission.
There's something wrong with that test if it's forcing you to make a normally writable sysctl read-only via kernel patch.
One would expect a sysctl like /proc/sys/kernel/randomize_va_space to be writable by root. Changing that would confuse a lot of people.
I can't find any documentation for this tool, only broken links on the web. Perhaps it has been fixed to make more sense?
On 28/06/2019 11:25, Maheshwari, Shagun wrote:
As per support for dASLR tool, "randomize_va_space_unconfigurable" fail means that "/proc/sys/kernel/randomize_va_space" has write permission.
I have checked both a Debian 4.14 and the very latest upstream mainline kernel 5.1.15 and all are the same permissions.
Since the latest Linux kernel doesn't agree with your tool that no-one has ever heard of, I'd say the problem is with the tool not the kernel.
Trevor
-
Jonathan Billings -
Maheshwari, Shagun -
Trevor Hemsley