Messages in this thread | | | Date | Tue, 25 Apr 2006 15:00:13 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [ANNOUNCE] Release Digsig 1.5: kernel module for run-timeauthentication of binaries |
| |
Quoting Chris Boot (bootc@bootc.net): > On 25 Apr 2006, at 17:11, Axelle Apvrille wrote: > > >- finally, note you also have choice not to sign this > >elf loader of yours. If it isn't signed, it won't ever > >run ;-) > > Wouldn't you need to sign, say, /lib/ld-linux.so? In that case, you > can simply get it to load an execute almost anything that's ELF, even
It uses dlopen, which does mmap(PROT_EXEC), at which point digsig will check for a signature.
If you rewrite it to not use mmap(PROT_EXEC), then the signature will not match. If you resign it, then you presumably know what you're doing.
I don't see the problem in this case.
> on filesystems marked noexec, if I'm not mistaken...
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |