[lkml]   [1997]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [linux-security] Malicious Linux modules (fwd)
> Loading modules lets potentially untrustworthy code into your trusted
> environment so the modules need checked first. A possible approach is
> to use code signing so the kernel can check that the code really was
> compiled by you.

Modules operate on _the same_ trust level as the kernel itself. If a
hacker can install a malicious module, he can as well install a
malicious kernel. (I.e. this attack is neither new nor a special Linux
risk, it just makes patching the kernel easier.)

So it is futile for the kernel to check module integrity - you need a
_higher_ trust level. "Higher trust level than the kernel" implies
media the kernel couldn't physically write to after the attack. I.e.
boot from a floppy and re-install everything from trusted media (CD,
backup tapes), check file signatures against separately stored media,

This applies above all to the kernel and module including their
respecitve sources. The next likely target are the standard system
utilities and compiler (as Thompson has proved, the compiler can never
be completely trusted, and this is an old hat too, but the probability
of a Thompson attack actually occuring is much lower than someone just
poking in the kernel sources...)


 \ /
  Last update: 2005-03-22 13:40    [W:0.054 / U:4.336 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site