[lkml]   [2003]   [May]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: The disappearing sys_call_table export.
>   Not on the systems I've seen.  Max log file size is 4GB and the
> logs are on their own partition. If the file fills up the system
> crashes immediately and only administrators can log in after reboot
> until the logs are archived.

Why would anyone design a system like that ?!
The logging of every security system is prone to flooding. You may have
noticed that your syslog sometimes spits "Last message repeated N times"
so it won't repeat itself. A system that doesn't deal with this issue in
any way can't be secure. There are a lot of methods to deal with it but I
think we're going seriously off-topic here so if anyone wishes to continue
discussing this specific logging problem, I suggest we switch to non-lkml

> Yes, but now any unsuccessful attempts to change the name will be
> logged, where before there was basically no risk for the attacker
> trying over and over until success. Even a single failure could
> raise an alert on the target machine, something a cracker definitely
> does not want to happen.

Not necessarily - it depends on the case. If the file being unlinked is
the logfile itself, and its checked by an cron job every once in a while
(a common situation), an attacker won't mind making a lot of noise into
the soon-to-be-a-free-inode logfile. After-the-fact security systems are
usually not suitable for server protection, and the system you suggest,
being statistical, is after-the-fact by definition.

Yoav Weiss

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:35    [W:0.073 / U:0.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site