Re: Linux kernel address leaks

[Michael Gilbert <michael.s.gilbert () gmail com>]

On Mon, 22 Nov 2010 18:01:20 -0500, Dan Rosenberg wrote:
> -It may or may not be acceptable to replace the addresses with 0's
> based on privilege level.

I don't see why it should be considered unacceptable to require
CAP_NET_ADMIN to be able to debug these low-level interfaces. In what
scenario would someone attempting to do so not have the ability to
elevate privileges on the system they're working on?  Better yet, how
is requiring elevated privs actually a real problem for this use case?
Your patches don't actually prevent debugging, they just require the
user/debugger to get authorization to do so.  Tell the kernel devs
that they need to explain why this is a real problem, and that their
habitual "no" is not acceptable.  You're doing great, thankless work.
Keep on fighting the good fight, and thank you.

Oh, and if you get CVEs assigned, that kind of forces them to fix the
problem, right?

Best wishes,
Mike