lkml.org 
[lkml]   [2000]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Direct access to hardware
On Sat, Jul 22, 2000 at 09:12:53PM +0400, you [Khimenko Victor] claimed:
>
> Grrr. It's doable from userspace. Just echo appropriate number in
> /proc/sys/kernel/cap-bound in /sbin/init (or early in rc.S) and that's all.

...sorry... I already apologized (for being stupid and not looking
closely enough before I posted) elsewhere in this thread, but in case you
missed that, consider this as an apologize.

> > Or are some of those always needed? If not, then they could be
> > disabled (do not enable what you don't need, as with /etc/inetd) on a
> > trivial web server box, route, firewall etc.
>
> You CAN disable it all with one small keystroke.

Ack. I just wasn't sure all the means to fry your hardware were covered by
CAP_SYS_RAWIO and friends.

> > Of course, kernel module loading should be disabled as well (or made
> > available only via challange-response authentication or something (*)).
>
> You can load all needed modules and then disable modules loading with the
> same /proc/sys/kernel/cap-bound ...

Good.

> > Make your boot media read-only, and the cracker shouldn't be able to
> > change the kernel either.
>
> > Which applications need (dangerous) direct hardware access?
>
> XFree86

X, dosemu and VMWare.

Then it would actually be feasible to use it in a lot of cases.

> > If nothing else, people running honey pot boxes to attract crackers would
> > propably want to use this.
>
> > Or is this a completely dead idea?
>
> It's not dead idea. Even more: such protection ALREADY is offered by kernel.

Ack.

> > (*) Publib key in kernel, private key held separately by the
> > administrator. Without writable /dev/mem (etc) this should work?
>
> No, this is not implemented (yet?).

It was just an idea. I'm not even sure it's waterproof - I _think_ it
could be, but I'm no guru.

> You can load all needed modules early in
> boot process and then disable everything non-needed (including ability to
> load modules).

For a workstation (and in certain cases, for a server as well) I generally
like to be able to load modules after reboot as well. But rootkits
nowadays include kernel modules to hide everything. If it is possible to
load this kind of stealth module (the same thing could propably be
accomplished via raw io as well, at least in theory), it not possible for
me to tell if the box has been compromised. Not even in theory. But if
loading modules and re-enabling raw io would require out-of-site private
key, there would be at least some parts in the system I could trust, even
if I'm not sure if it has been compromised.


-- v --

v@iki.fi

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:57    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site