lkml.org 
[lkml]   [2007]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Versioning file system
    On Tue, Jun 19, 2007 at 12:26:57AM +0200, Jörn Engel wrote:
    > The main difference appears to be the potential size. Both extended
    > attributes and forks allow for extra data that I neither want or need.
    > But once the extra space is large enough to hide a rootkit in, it
    > becomes a security problem instead of just something pointless.

    The other difference is that you can't execute an extended attribute.

    You can store kvm/qemu, a complete virtualization enviroment, shared
    libraries, and other executables all inside a forks inside a file, and
    then execute programs/rootkit out of said file fork(s).

    As I mentioned in my LCA presentation, one system administrator
    refused to upgrade beyond Solaris 8 because he thought forks were good
    for nothing but letting system crackers hide rootkits that wouldn't be
    detected by programs like tripwire. The question then is why in the
    world would we want to replicate Sun's mistakes?

    - Ted
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-06-19 09:05    [W:0.046 / U:61.020 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site