Messages in this thread |  | | | Date | Thu, 4 Sep 2008 15:06:09 +0200 | | From | Andi Kleen <> | | Subject | Re: [patch] Add basic sanity checks to the syscall execution patch |
On Thu, Sep 04, 2008 at 01:34:19PM +0100, Alan Cox wrote:
> On Thu, 04 Sep 2008 14:01:46 +0200
> Andi Kleen <andi@firstfloor.org> wrote:
>
> > Arjan van de Ven <arjan@infradead.org> writes:
> >
> > > Add basic sanity checks to the syscall execution patch
> >
> > This just means that the root kits will switch to patch
> > the first instruction of the entry points instead.
> >
> > So the protection will be zero to minimal, but the overhead will
> > be there forever.
>
> Agreed entirely. This is a waste of time and a game not worth playing.
> The only place you can expect to make a difference here is in virtualised
Even that can be circumvented by patching indirect pointers (or pointer
to objects with indirect pointers) in any writable object. Or in
a couple of other ways.
But yes it would still seem like a reasonable useful improvement.
-Andi
--
ak@linux.intel.com
|  |