lkml.org 
[lkml]   [1999]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Sealing the kernel
Date
John Langford writes ("Re: Sealing the kernel "):
>
> I think there just doesn't exist an elegant way to make 'seal.o'
> selectively porous to preselected modules. It's logically possible using
> md5, but not mechanically possible because of the relocation which occurs
> in user space. For anyone with ideas: I'm all ears.

Instead of trying to verify that the kernel module is what you
expected, check that the module loader's checksumming is correct
(/sbin/modprobe).

You will either have to statically link the loader or check the
libraries and ELF interpreter too. Once the kernel knows it is running
the genuine module loader, it can give it the extra capabilities it
needs to install modules; /sbin/modprobe can then implement your
security policy. The module loader is in a much better position than
the kernel to check module signatures, which is an approach I'd much
prefer to simple checksumming.

Obviously, you will need to stop the module loader from being tampered
with once it has started running. You will need to prevent the use of
ptrace to gain privilege (even for root), and since binaries are
demand page loaded, you will need to prevent the image on disk from
being altered. Also, setuid 'root' programs will need to be given less
than the full set of capabilities, but that's required for other
reasons anyway (eg. protection of immutible files).

Peter

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:54    [W:0.497 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site