Messages in this thread | | | Subject | Re: Testers wanted: exorcised kmod.c: no more daemon! | Date | Mon, 13 Apr 1998 13:58:35 -0700 | From | Craig Milo Rogers <> |
| |
> The following patch eliminates the kmod deamon by having ... >Caveats: ... > o If you want autoloading of modules from anonymous FTP > for some reason, you must make a copy of /sbin/modprobe > and lib/modules/<kernel_version> accessible from the > anonymous FTP area, as you already do with the executables > shared libraries if you want to use them from anonymous > FTP sessions.
Ugh! But this sounds like you'd just opened a wound in security. I can imagine circumstances in which someone might want to allow an anonymous FTP user to access data through a path that requires an autoloaded kernel module, but loading kernel modules from the anonymous FTP area itself??? Even if the kernel module files have file protections that prevent access by the anonymous FTP server's processes in normal conditions, you've created an outstanding way to infect the kernel and take over the system if that first layer of protection is broken.
Can you think of a way to allow some chroot's, such as boot device changes, to be followed, while disallowing other ones?
Craig Milo Rogers
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu
| |