lkml.org 
[lkml]   [1999]   [Dec]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: malware defense
Date
From

sct@redhat.com said:
> Encryption != authentication. As long as the module plaintext isn't
> encrypted, I wouldn't have thought there would be any problems with
> adding signatures.

Adding signatures to the modules before they're relocated doesn't buy you much
if you then just allow modprobe to do the relocation itself.

The linker (in modprobe) can do nasty things with the relocations - so if you
just checksum it before it's linked then you can still be vulnerable.

To really do this securely, I suspect we'd need to actually put the linker
into the kernel, rather than having it in modprobe as it is at the moment.



--
dwmw2



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.037 / U:0.944 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site