lkml.org 
[lkml]   [2003]   [Aug]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] Allow /dev/{,k}mem to be disabled to prevent kernel from being modified easily
On Sun, Aug 03, 2003 at 02:33:01PM -0700, David Lang wrote:

> we already have the option to not support modules (as Alan Cox points out
> every time that subject comes up it can be bypassed by people who have
> access to /dev/*mem) so it would seem that adding the option to bar access
> to /dev/*mem as well would make exisitng config options mean what they
> appear to mean.

This was also on my mind, yes. As Wichert said, not all holes are closed
then, there is also /dev/microcode, iopl() and more.

However, perhaps we could all sweep them under the "don't allow userspace to
touch kernel memory easily" banner?

We can leave more finegrained tools to outside patchsets then.

I think root will always be able to figure out a way to get into the
kernel's innards, but we can raise the bar quite a lot easily without too
much infrastructure.

As to what Alan said about LSM, I've yet to see how to do that in a
reasonable way. But I didn't look too hard.

As to what Andries said, how about '/proc/sys/raw_memory_access'?

Thanks.

--
http://www.PowerDNS.com Open source, database driven DNS Software
http://lartc.org Linux Advanced Routing & Traffic Control HOWTO
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:47    [from the cache]
©2003-2011 Jasper Spaans