Messages in this thread | | | Date | Mon, 29 Nov 2004 05:47:42 -0500 | From | Jim Nelson <> | Subject | Re: Question about /dev/mem and /dev/kmem |
| |
Wichert Akkerman wrote: > Previously Jim Nelson wrote: > >>I was looking at some articles about rootkits on monolithic kernels, and >>had a thought. Would a kernel config option to disable write access to >>/dev/mem and /dev/kmem be a workable idea? > > > Yes, but not a very useful one since it is an incomplete solution. You > can easily do something better using /proc/kernel/cap-bound
Isn't that /proc/sys/kernel/cap-bound?
> (like writing 0xFFFCFFFF into it). >
And what stops an attacker who's already gained root from doing a "cat "0" > /proc/sys/kernel/cap-bound" ?
> Wichert. >
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |