Messages in this thread | | | Subject | Re: Sealing the kernel | Date | Tue, 26 Oct 1999 14:09:39 -0400 | From | Dimitris Margaritis <> |
| |
> You have a good idea...But what goes is it really when the person can just > go ahead a recompile a kernel...replace the current one and then cause the > system to "crash". Unless of course you are booting off of some sort of > read-only media(A write protected floppy comes to mind). Also, another > idea, backdoor insmod/modprobe so that your special module doesn't get > loaded again in the future. Its really impossible to protect the machine > from root. Sure you can keep them out of the kernel level stuff. But > what good is that really? The root user could still do nasty things to > your system regardless. > > > Aaron >
Yes, John forgot to mention that we're assuming boot from a read-only media such as a write-protected floppy or CD-ROM. We also assume that the rc scripts, kernel, and all modules to be loaded at boot time (before of course the sealing module) also reside on that medium.
About your last point, yes, root can do a lot of nasty things, but by sealing the kernel at least they are constrained to what's available through kernel services. That may help presumably by disabling a lot of stuff in the running kernel.
-- Dimitris
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |