/boot/vmlinuz-* readable only by root, preventing userspace tools like libguestfs from using host kernel.

[Marc Deslauriers]

On 14-05-22 05:18 AM, John Johansen wrote:
> On 05/22/2014 01:24 AM, Robie Basak wrote:
>> This will probably want the attention of the kernel team for a reply, so
>> forwarding there. Is there maybe a security reason why it is arranged
>> this way? I note that System.map is the same.
>>
> 
> It was done deliberately to make it harder for an attacker to obtain
> information about the kernel (addresses of kernel symbols). However the
> actual value of doing this is nominal as an attacker can download the file
> and hard code the addresses with in an exploit or have the exploit down
> load the file it self, or use a service like ksymhunter.
> 
> 

Right, it was done as a security measure to prevent generic exploits from
working. Preventing read access to those files forces the exploit to have
built-in knowledge of Ubuntu and the exact kernel the user is running instead of
simply looking the symbols up.

Here is the bug report about it:
https://bugs.launchpad.net/bugs/759725

This is not something we should change. There are workarounds for local admins
who don't care about this security feature here:

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/759725/comments/3

If this is a common issue, we could possibly either supply the workaround
disabled by default, or possibly create a new group that users can opt-in to.

Marc.