[lkml]   [2002]   [Oct]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: One for the Security Guru's
    Alan Cox <> writes:

    >On Thu, 2002-10-24 at 12:09, Henning P. Schmiedehausen wrote:
    >> Ville Herva <> writes:
    >> >the /dev/kmem hole, but this closes 2 classes of attacks - loading rootkit
    >> >module and booting with a hacked kernel in straight-forward way.
    >> Question: What do I lose when you remove /dev/kmem?
    >> Related question: Would it be useful to make /dev/kmem read-only?

    >Makes no real difference. If the user got to root they can work the
    >chmod command. What you want to do is revoke CAP_SYS_RAWIO which kills
    >off all direct hardware access - mem/kmem/iopl/ioperm etc. It does stop
    >non kernel fb X working but thats not a big deal on a server.


    I've been in a hurry when I wrote my first mail. What I meant was:

    - I remove drivers/char/mem.c from my kernel. What do I lose? (/dev/null,
    /dev/zero and /dev/full afaics but cut this down to "i remove everything
    related to mem_fops, kmem_fops and port_fops").

    - I remove write_mem(), write_kmem() and write_port() from drivers/char/mem.c
    What do I lose?

    Removing CAP_SYS_RAWIO is nice, but I actually want to remove the code
    from the kernel, not just disabling it (Yes, of course I could try but
    my test box is in pieces ATM...).

    The pointer to the Xserver is a good one. Thanks.


    Dipl.-Inf. (Univ.) Henning P. Schmiedehausen -- Geschaeftsfuehrer
    INTERMETA - Gesellschaft fuer Mehrwertdienste mbH

    Am Schwabachgrund 22 Fon.: 09131 / 50654-0
    D-91054 Buckenhof Fax.: 09131 / 50654-20
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:30    [W:0.021 / U:2.144 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site