Messages in this thread |  | | | Date | Thu, 4 Sep 2008 15:06:09 +0200 | | From | Andi Kleen <> | | Subject | Re: [patch] Add basic sanity checks to the syscall execution patch |
| |
On Thu, Sep 04, 2008 at 01:34:19PM +0100, Alan Cox wrote: > On Thu, 04 Sep 2008 14:01:46 +0200 > Andi Kleen <andi@firstfloor.org> wrote: > > > Arjan van de Ven <arjan@infradead.org> writes: > > > > > Add basic sanity checks to the syscall execution patch > > > > This just means that the root kits will switch to patch > > the first instruction of the entry points instead. > > > > So the protection will be zero to minimal, but the overhead will > > be there forever. > > Agreed entirely. This is a waste of time and a game not worth playing. > The only place you can expect to make a difference here is in virtualised
Even that can be circumvented by patching indirect pointers (or pointer to objects with indirect pointers) in any writable object. Or in a couple of other ways.
But yes it would still seem like a reasonable useful improvement.
-Andi
-- ak@linux.intel.com
|  |