unexporting sys_call_table a good idea?

[Paul Clements]

Hi all,

given the recent ptrace-related security bug, it sure would be nice to
have sys_call_table exported, so that I could just disable ptrace
altogether on affected systems (where no one is doing any debugging or
devel work, anyway)... I realize that there are race conditions, etc.,
with replacing syscalls, but could those not be solved?... as it is,
rather than being able to simply compile an external module (which
disables ptrace) and load it on affected systems, I am forced to
recompile an entire kernel, install it on the affected systems, and
reboot them all...

Thanks,
Paul