Messages in this thread | | | From | fvw <> | Subject | RE: Disabling module loading with a module? | Date | Tue, 17 Aug 1999 15:36:02 +0200 |
| |
On Tue, 17 Aug 1999, Jones D (ISaCS) wrote: > You missed my point. > The attack would have gained root. He could 'exec rm -rf /' > or fdisk, or 'cat /dev/random > /dev/sda', or _anything_ else. True, at the moment the attack succeeds the machine is lost. But the danger is with machines on trust-networks. This would hinder covering up so an attack on the next host could be mounted.
BTW: cat /dev/random > /dev/sda would be *bloody* slow.
> Disabling modules interface won't stop bad people doing bad things. > It will just stop good people doing anything productive. That is why the user always has the choice whether or not to use security feature X. I'm not suggesting putting it in the main kernel defaulting it to on, I'm just poking around, looking for opinions and enlightenment.
> Time would be better spent improving security elsewhere. > Instead of thinking of ways to stop people doing things when they get in, > stop them getting in in the first place.. I like to try at least both. But I agree, securing getting in bit is certainly higher priority.
--
Frank v Waveren fvw@chello.nl ICQ# 10074100
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |