[lkml]   [2000]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Direct access to hardware
    On Sat, Jul 22, 2000 at 09:12:53PM +0400, you [Khimenko Victor] claimed:
    > Grrr. It's doable from userspace. Just echo appropriate number in
    > /proc/sys/kernel/cap-bound in /sbin/init (or early in rc.S) and that's all.

    ...sorry... I already apologized (for being stupid and not looking
    closely enough before I posted) elsewhere in this thread, but in case you
    missed that, consider this as an apologize.

    > > Or are some of those always needed? If not, then they could be
    > > disabled (do not enable what you don't need, as with /etc/inetd) on a
    > > trivial web server box, route, firewall etc.
    > You CAN disable it all with one small keystroke.

    Ack. I just wasn't sure all the means to fry your hardware were covered by
    CAP_SYS_RAWIO and friends.

    > > Of course, kernel module loading should be disabled as well (or made
    > > available only via challange-response authentication or something (*)).
    > You can load all needed modules and then disable modules loading with the
    > same /proc/sys/kernel/cap-bound ...


    > > Make your boot media read-only, and the cracker shouldn't be able to
    > > change the kernel either.
    > > Which applications need (dangerous) direct hardware access?
    > XFree86

    X, dosemu and VMWare.

    Then it would actually be feasible to use it in a lot of cases.

    > > If nothing else, people running honey pot boxes to attract crackers would
    > > propably want to use this.
    > > Or is this a completely dead idea?
    > It's not dead idea. Even more: such protection ALREADY is offered by kernel.


    > > (*) Publib key in kernel, private key held separately by the
    > > administrator. Without writable /dev/mem (etc) this should work?
    > No, this is not implemented (yet?).

    It was just an idea. I'm not even sure it's waterproof - I _think_ it
    could be, but I'm no guru.

    > You can load all needed modules early in
    > boot process and then disable everything non-needed (including ability to
    > load modules).

    For a workstation (and in certain cases, for a server as well) I generally
    like to be able to load modules after reboot as well. But rootkits
    nowadays include kernel modules to hide everything. If it is possible to
    load this kind of stealth module (the same thing could propably be
    accomplished via raw io as well, at least in theory), it not possible for
    me to tell if the box has been compromised. Not even in theory. But if
    loading modules and re-enabling raw io would require out-of-site private
    key, there would be at least some parts in the system I could trust, even
    if I'm not sure if it has been compromised.

    -- v --

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:57    [W:0.021 / U:2.792 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site