[lkml]   [2003]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] Allow /dev/{,k}mem to be disabled to prevent kernel from being modified easily
On Sul, 2003-08-03 at 19:09, bert hubert wrote:
> up about Oppenheimer when disclaiming that you are 'just a coder'. The item
> to google on is: "ethics sweetness hydrogen bomb Oppenheimer"), I wrote
> a patch to disable /dev/kmem and /dev/mem, which is harmless on servers
> without X.

You can do this without modifications using the security interface
hooks. If you want to do it right with 2.4 or without security modules
you need to globally revoke CAP_SYS_RAWIO and CAP_SYS_MODULE otherwise
you merely made it harder.

> It blocks attempts by rootkits, such as devik's SucKIT, to hide themselves.
> It is not a final solution but it raises the bar a lot. Please apply.

Fine in theory but you can do this via security modules so its better if
you write a security policy module for it.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:47    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean