Messages in this thread | | | From | (David Wagner) | Subject | Re: [patch 1/2] [RFC] Simple tamper-proof device filesystem. | Date | Mon, 17 Dec 2007 01:19:30 +0000 (UTC) |
| |
Tetsuo Handa writes: >When I attended at Security Stadium 2003 as a defense side, >I was using devfs for /dev directory. The files in /dev directory >were deleted by attckers and the administrator was unable to login.
If the attacker gets full administrator-level access on your machine, there are a gazillion ways the attacker can prevent other admins from logging on. This patch can't prevent that. It sounds like this patch is trying to solve a fundamentally unsolveable problem.
A useful slogan: "Don't forbid what you cannot prevent."
| |