Messages in this thread | | | Date | Sat, 22 Jul 2000 22:27:01 +0300 | From | Ville Herva <> | Subject | Re: Direct access to hardware |
| |
On Sat, Jul 22, 2000 at 09:12:53PM +0400, you [Khimenko Victor] claimed: > > Grrr. It's doable from userspace. Just echo appropriate number in > /proc/sys/kernel/cap-bound in /sbin/init (or early in rc.S) and that's all.
...sorry... I already apologized (for being stupid and not looking closely enough before I posted) elsewhere in this thread, but in case you missed that, consider this as an apologize.
> > Or are some of those always needed? If not, then they could be > > disabled (do not enable what you don't need, as with /etc/inetd) on a > > trivial web server box, route, firewall etc. > > You CAN disable it all with one small keystroke.
Ack. I just wasn't sure all the means to fry your hardware were covered by CAP_SYS_RAWIO and friends.
> > Of course, kernel module loading should be disabled as well (or made > > available only via challange-response authentication or something (*)). > > You can load all needed modules and then disable modules loading with the > same /proc/sys/kernel/cap-bound ...
Good.
> > Make your boot media read-only, and the cracker shouldn't be able to > > change the kernel either. > > > Which applications need (dangerous) direct hardware access? > > XFree86
X, dosemu and VMWare.
Then it would actually be feasible to use it in a lot of cases.
> > If nothing else, people running honey pot boxes to attract crackers would > > propably want to use this. > > > Or is this a completely dead idea? > > It's not dead idea. Even more: such protection ALREADY is offered by kernel.
Ack.
> > (*) Publib key in kernel, private key held separately by the > > administrator. Without writable /dev/mem (etc) this should work? > > No, this is not implemented (yet?).
It was just an idea. I'm not even sure it's waterproof - I _think_ it could be, but I'm no guru.
> You can load all needed modules early in > boot process and then disable everything non-needed (including ability to > load modules).
For a workstation (and in certain cases, for a server as well) I generally like to be able to load modules after reboot as well. But rootkits nowadays include kernel modules to hide everything. If it is possible to load this kind of stealth module (the same thing could propably be accomplished via raw io as well, at least in theory), it not possible for me to tell if the box has been compromised. Not even in theory. But if loading modules and re-enabling raw io would require out-of-site private key, there would be at least some parts in the system I could trust, even if I'm not sure if it has been compromised.
-- v --
v@iki.fi
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |