lkml.org 
[lkml]   [2004]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Fw: signed kernel modules?
> On Sun, 17 Oct 2004, Bodo Eggert wrote:
> > Richard B. Johnson wrote:

> >> One can make a 'certified' kernel with 'certified' modules
> >> for some hush-hush project. Adding this kind of junk isn't
> >> how it's done. You just take your favorite kernel with the
> >> modules you require, you verify that it meets your security
> >> requirements, then you CRC the kernel and its modules. You
> >> keep the CRCs somewhere safe, available from a read-only
> >> source like a CD/ROM or a network file-server.
[...]

> > If a malicious module loads, you lose instantly. You cannot relaibly
> check
> > module integrity on this system anymore. E.g. the malicious module might
> > patch the module checker to check a signed module instead of the
> malicious
> > one. Or the Exploit saves the old module, puts in the patched one, loads
> it
> > and puts the old one back in place.

> What malicious module? They have all been certified. That ARE NO
> OTHER modules.

At least until an attacker uploads a malicious module or modifies one of the
(untill then) certified modules. (He can, because your kernel doesn't check
them while loading.)

> If you don't do it this way, i.e., if you allow
> anybody to load a module, then you have no security, regardless of
> what's in the module, the loader, or the kernel. Any crap inside
> either of these is crap. Then can all be modified to do anything
> so gigibytes of "protective" software is absouye bullshit, and
> a lot of memory wasted.

If your box is r00ted, you'll want to notice this fact and do something
against it. If you don't prevent loading malicious modules, the attacker can
hide his presence and use your system right under your eyes, and you won't
notice (even while checking the checksumes).

Signing modules is (off cause) just one step, the next one(s) would be to
prevent all other modifications to the kernel memory.

--
Geschenkt: 3 Monate GMX ProMail + 3 Ausgaben der TV Movie mit DVD
++++ Jetzt anmelden und testen http://www.gmx.net/de/go/mail ++++

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:07    [W:0.054 / U:0.404 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site