From c4edb7ed468704f63b0d840d6254da4f4562d93c Mon Sep 17 00:00:00 2001
From: Kyle McMartin <kyle@mcmartin.ca>
Date: Wed, 17 Nov 2010 00:37:01 -0500
Subject: [PATCH] make vmlinuz/System.map root-only by default

---
 kernel.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/kernel.spec b/kernel.spec
index c1b9cb9ed..e70b1ba50 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -1896,8 +1896,8 @@ fi
 %if %{1}\
 %{expand:%%files %{?2}}\
 %defattr(-,root,root)\
-/%{image_install_path}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?2:.%{2}}\
-/boot/System.map-%{KVERREL}%{?2:.%{2}}\
+%attr(600,root,root) /%{image_install_path}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?2:.%{2}}\
+%attr(600,root,root) /boot/System.map-%{KVERREL}%{?2:.%{2}}\
 /boot/config-%{KVERREL}%{?2:.%{2}}\
 %dir /lib/modules/%{KVERREL}%{?2:.%{2}}\
 /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel\
@@ -1955,6 +1955,10 @@ fi
 #                 ||     ||
 
 %changelog
+* Wed Nov 17 2010 Kyle McMartin <kyle@redhat.com>
+- Make vmlinuz/System.map root read-write only by default. You can just
+  chmod 644 them later if you (unlikely) need them without root.
+
 * Tue Nov 16 2010 Kyle McMartin <kyle@redhat.com> 2.6.36-4
 - Disable parallel doc builds, they fail. Constantly.