Messages in this thread | | | Date | Sun, 20 Jan 2002 20:07:12 -0500 (EST) | From | "Mr. James W. Laferriere" <> | Subject | Re: Hardwired drivers are going away? |
| |
Hello Anton ,
On Mon, 21 Jan 2002, Anton Altaparmakov wrote: > At 23:20 20/01/02, Frank van de Pol wrote: > >On Sat, Jan 19, 2002 at 10:22:43AM +1100, Keith Owens wrote: > > > On Fri, 18 Jan 2002 17:20:02 -0500 (EST), > > > "Mr. James W. Laferriere" <babydr@baby-dragons.com> wrote: > > > > Linux doesn't have a method to load encrypted & signed modules at > > > > this time . > > > And never will. Who loads the module - root. Who maintains the list > > > of signatures - root. Who controls the code that verifies the > > > signature - root. > > > Your task Jim, should you choose to accept it, is to make the kernel > > > distinguish between a good use of root and a malicious use by some who > > > has broken in and got root privileges. When you can do that, then we > > > can add signed modules. > >If you want to secure your box, why don't you simply put a lock on it and > >throw away the key? Really, what might help the paranoid admins in this case > >is a setting in the kernel which basically disables the ability to load or > >unload modules. Of course once set this setting can not been turned with > >rebooting the box.
> Er that sounds like just disabling modules in the kernel altogether (kernel > compile option exists for this since the beginning of time)... I do that on > all servers I control. Not only for security reasons but also because I > suspect it produces smaller and probably faster kernels (I haven't tested > this in any way, just a guess). This is just what the Heads are trying to do away with . There will only be module enabled kernels . JimL
+------------------------------------------------------------------+ | James W. Laferriere | System Techniques | Give me VMS | | Network Engineer | P.O. Box 854 | Give me Linux | | babydr@baby-dragons.com | Coudersport PA 16915 | only on AXP | +------------------------------------------------------------------+
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |