Messages in this thread | | | Date | Mon, 27 Mar 2006 02:05:16 -0800 | From | Linda Walsh <> | Subject | Re: Save 320K on production machines? |
| |
Andre Tomt wrote: > Linda Walsh wrote: > <snip> >> To minimize >> problems, I disable unused hardware, and all _used_ hardware >> is compiled in (no module loading overhead, no chances for >> arbitrary code insertion). > > FYI, rootkits have been able to cope with inserting kernel code > without using the modules support for ages. It is only makes it > marginally harder. > --- True, but that's the point. People break into systems with passwords. Just because passwords aren't 100% effective in protecting systems doesn't mean we don't use them. :-)
The point is to "minimize" a vulnerability profile. I'm wondering why unused code is required to be compiled in to standard kernels. It seems very un-linux like -- more like Windows that has support for everything compiled in.
Reducing code bloat is not just a good idea for embedded systems. It's good for performance and security if for no other reason that there are fewer lines that could go wrong. :-)
-l
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |