lkml.org 
[lkml]   [2006]   [Mar]   [27]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateMon, 27 Mar 2006 02:05:16 -0800
FromLinda Walsh <>
SubjectRe: Save 320K on production machines?
Andre Tomt wrote:
> Linda Walsh wrote:
> <snip>
>> To minimize
>> problems, I disable unused hardware, and all _used_ hardware
>> is compiled in (no module loading overhead, no chances for
>> arbitrary code insertion).
>
> FYI, rootkits have been able to cope with inserting kernel code 
> without using the modules support for ages. It is only makes it 
> marginally harder.
>
---
    True, but that's the point.  People break into systems with
passwords.  Just because passwords aren't 100% effective in
protecting systems doesn't mean we don't use them.  :-)

    The point is to "minimize" a vulnerability profile.
    I'm wondering why unused code is required to be compiled
in to standard kernels.  It seems very un-linux like -- more like
Windows that has support for everything compiled in.

    Reducing code bloat is not just a good idea for embedded systems.
It's good for performance and security if for no other reason that
there are fewer lines that could go wrong. :-)

-l

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-03-27 12:07    [from the cache]
©2003-2008