dkms and corruption of kernel-devel package

[Josh Boyer]

On Fri, Aug 24, 2012 at 11:34 AM, John Reiser <jreiser at bitwagon.com> wrote:
>> the copy in /usr/src/kernels/ is
>> world-readable and the one in /boot/ isn't, for example
>>
>> [root at compaq-pc ~]# ls -l /boot/System.map-3.5.2-3.fc17.x86_64 /usr/src/kernels/3.5.2-3.fc17.x86_64/System.map
>> -rw-------. 1 root root 2468248 Aug 21 15:24 /boot/System.map-3.5.2-3.fc17.x86_64
>> -rw-r--r--. 1 root root 2468248 Aug 21 15:25 /usr/src/kernels/3.5.2-3.fc17.x86_64/System.map
>> [root at compaq-pc ~]#
>
>
> /boot/System.map is always-present system-specific info which may be useful
> to malware for an attack on the running system.

No.

> The version in /usr/src/kernels is not present on every machine,
> and is more generic: at least a little bit less likely to be correct
> for the currently-running kernel.

No.

Unless you've built your own kernel and changed the config, the files
for that particular kernel version are identical.

The kernel-devel copy is 644 because if it was 600 you'd have to build
things against it as root (or change it to 644).  You are correct that
kernel-devel is not installed on every machine though.

josh