Messages in this thread | | | From | (Peter Benie) | Subject | Re: Sealing the kernel | Date | Thu, 28 Oct 1999 10:14:37 +0100 |
| |
John Langford writes ("Re: Sealing the kernel "): > > I think there just doesn't exist an elegant way to make 'seal.o' > selectively porous to preselected modules. It's logically possible using > md5, but not mechanically possible because of the relocation which occurs > in user space. For anyone with ideas: I'm all ears.
Instead of trying to verify that the kernel module is what you expected, check that the module loader's checksumming is correct (/sbin/modprobe).
You will either have to statically link the loader or check the libraries and ELF interpreter too. Once the kernel knows it is running the genuine module loader, it can give it the extra capabilities it needs to install modules; /sbin/modprobe can then implement your security policy. The module loader is in a much better position than the kernel to check module signatures, which is an approach I'd much prefer to simple checksumming.
Obviously, you will need to stop the module loader from being tampered with once it has started running. You will need to prevent the use of ptrace to gain privilege (even for root), and since binaries are demand page loaded, you will need to prevent the image on disk from being altered. Also, setuid 'root' programs will need to be given less than the full set of capabilities, but that's required for other reasons anyway (eg. protection of immutible files).
Peter
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |