lkml.org 
[lkml]   [2008]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch] Add basic sanity checks to the syscall execution patch
On Thu, Sep 04, 2008 at 01:34:19PM +0100, Alan Cox wrote:
> On Thu, 04 Sep 2008 14:01:46 +0200
> Andi Kleen <andi@firstfloor.org> wrote:
>
> > Arjan van de Ven <arjan@infradead.org> writes:
> >
> > > Add basic sanity checks to the syscall execution patch
> >
> > This just means that the root kits will switch to patch
> > the first instruction of the entry points instead.
> >
> > So the protection will be zero to minimal, but the overhead will
> > be there forever.
>
> Agreed entirely. This is a waste of time and a game not worth playing.
> The only place you can expect to make a difference here is in virtualised

Even that can be circumvented by patching indirect pointers (or pointer
to objects with indirect pointers) in any writable object. Or in
a couple of other ways.

But yes it would still seem like a reasonable useful improvement.

-Andi

--
ak@linux.intel.com


\
 
 \ /
  Last update: 2008-09-04 15:05    [W:0.086 / U:21.100 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site