Comment 9 for bug 759725

I recognize this can get in some people's way, which is why I've tried to demonstrate how to adjust the local system to retain the more open permissions.

I am not saying they're hidden from being looked up externally (just fetching the kernel package's System.map file is easiest). But because the symbols can be extracted in the way you point out is why the kernel image itself needs to be unreadable. This change is to block the class of attacks carried out by script kiddies and automated systems that expect to be able to look up symbols locally and make exploits totally portable to all kernel versions. It changes the nature of future attacks, at least forcing attackers to take additional steps.

The postinst.d and prerm.d solution should provide a reasonable work-around for the small number of systems that need it.