lkml.org 
[lkml]   [2004]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectQuestion about /dev/mem and /dev/kmem
I was looking at some articles about rootkits on monolithic kernels, and had a 
thought. Would a kernel config option to disable write access to /dev/mem and
/dev/kmem be a workable idea?

I know it'll kill X (unless you're using the framebuffer X server), but would
there be any other big problems? SELinux has a finer-grained control over those
files, but also involves a bit of administrative and system overhead.

I see this as an option that could be used in routers, web servers, firewalls and
other systems that have a greater risk of exposure to rootkits. Granted, it only
makes sense with a monolithic kernel, but most people nowadays would only use
monolithic kernels for security reasons. You could also put a couple of
printk()'s in to raise alarms if someone does try to open the device file for writing.

Am I speaking ex rectum? Granted, I'm kinda new to this, but I can't see any
reason not to offer the choice to someone compiling a kernel - and I think it
could be done with a minimum of code bloat.

I offer this to the firing range ;)

Jim
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:08    [W:0.049 / U:1.388 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site