Messages in this thread | | | Date | Tue, 17 Aug 1999 10:44:25 -0500 | From | Ben Collins <> | Subject | Re: Disabling module loading with a module? |
| |
On Tue, Aug 17, 1999 at 02:15:47PM +0100, Jones D (ISaCS) wrote: > What would be the point of this? > Normal users can't insert modules anyway. Knocking out support for > modules insertion after startup just imposes limitations.
Limitations are not imposed if you don't use it.
> If a hacker has got the privs to insert modules, he could recompile > a kernel without the module-lockout-after-startup routines anyhow.
Well this same argument could discount secure levels and the like aswell, but they are useful. The point is, that when your kernel is recompiled and your system is rebooted, you have a fair chance of discovering this, more so than you would if a module were simply loaded in and the system left intact.
I personally don't use modules to avoid this altogether, but I might consider it if I could "lock" them out after reboot. Another alternative could be to require some sort of secure method for loading modules, other than just having uid 0. For example a kernel key/id system with a passphrase. This is all completely complicated to develop (and maybe overkill for most users), but it's an option.
> Personally I feel this would be a wasted effort.
Nothing personal, but it's some one else effort to waste.
Ben
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |