lkml.org 
[lkml]   [2003]   [May]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: The disappearing sys_call_table export.
On Fri, May 09, 2003 at 01:08:08AM -0700, Greg KH wrote:
> On Fri, May 09, 2003 at 10:42:08AM +0300, Muli Ben-Yehuda wrote:
> >
> > For example, a rogue process is calling settimeofday() on your router
> > once a month(!). How are you going to find it? There's no LSM hook for
> > settimeofday()
>
> Yes there is. Check the capable hook for CAP_SYS_TIME. LSM modules can
> get that info quite easily.

Indeed, I missed the fact that LSM modules have a capable
hook. Nonetheless, my original point stands: LSM and hooking kernel
objects are great for security and auditing, hijacking system calls
can be quite useful for debugging, both kernel and userspace.

Thanks,
Muli.
--
Muli Ben-Yehuda
http://www.mulix.org

[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 13:35    [W:0.033 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site