Messages in this thread | | | Date | Fri, 28 Jan 2000 23:41:48 -0000 (GMT) | From | Anton Ivanov <> | Subject | Re: [PATCH] boobytrap for 2.2.15pre5 |
| |
-----BEGIN PGP SIGNED MESSAGE-----
On 28-Jan-2000 glouis@dynamicro.on.ca wrote: > On Fri, 28 Jan 2000, Petri Kaukasoina wrote: > >> >>> Addresses in System.map are between c0100000 and c01cfabc and I don't >> >>> use >> >>> modules. >> > > >> > > kmem_cache_alloc called by non-running (1) task from c37ff020! >> > > kmem_cache_alloc called by non-running (1) task from c37ff080! >> > > kmem_cache_alloc called by non-running (1) task from c37ff8c0! >> > > kmem_cache_alloc called by non-running (1) task from c37ff920! >> > > kmem_cache_alloc called by non-running (2) task from c37ff8c0! >> > > >> > > I have 56 megs of memory (56M = 03800000). >> > >> > Sorry to state the obvious, but are you sure the System.map you are >> > checking is the one generated when this patched kernel was compiled? >> >> Yes. >> >> The addresses c37ffxxx are just below the end of memory (56 megs) calculated >> from c0000000. The addresses in the System.map are in the beginning of the >> memory from c0000000. > > Me too. > I'm getting ...non-running (1) task from c3fff8c0 and c3fff920 in strict > alternation, every few seconds. During boot-up there was also one with > status 4 from 8c0 and one with status 1 from 860 (all > c3fff---). Symbols in "cat proc/ksyms | sort" go up to c02796c8 > (pci-root) and then the next symbol is an __insmod at c4806000. The > machine in question has 64Mb of ram. >
I have the following question about this patch. What will happen if a kernel root kit module has been installed that hides tasks, I/O calls and networking?
I am not suggesting that the two machines in question may have this problem. I am asking in general. Can this patch be also considered a security measure for at least some of the kernel module root kits? They should be calling sched and so on quite often when they are not supposed to/expected to in order to work...
- ---------------------------------- Anton R. Ivanov IP Engineer Level3 Communications RIPE: ARI2-RIPE E-Mail: Anton Ivanov <aivanov@eu.level3.net> @*** Kamin's Laws (No 2 of 7) *** Threat of capital controls accelerates marginal capital outflows.
- ---------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org
iQEVAwUBOJIpOylWAw/bM84zAQHvQQf+LhwGuVpOwZyS0WO/113oJsUxeQT9kCMq X2kol8TpUgtmTQNiKNiQfsPI72OAntcipd1gDB9QV8hceSgQAaquxzJl3BLesq9b +3xuvRgnFoOe28oPkieJUbeLwKLzImP+hhkz69/jFiYHgsoGSoPTzoR3lTXo0HEP 9RFr4ExwqCtGbSrP1jIaNQU4LiLEUoOWSckr5H9HeCRYT9++r0cM4y7PFG1iftMU klgpXHP4ImHd/srS5jcbpTk+dfCndMt7xIU4KS1EqQilW58b+G6RLXzypUM9jOlN 4UhqfTqAtBNYtVfDO7pXRwe1p9f2c1AK+j8ykm3BriiEG1bfjtbSTQ== =/oau -----END PGP SIGNATURE-----
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |