On Mon, 21 Jan 2002 04:49:52 +0100
Andreas Ferber <aferber@techfak.uni-bielefeld.de> wrote:
> On Mon, Jan 21, 2002 at 09:54:58AM +0900, Bruce Harada wrote:
> >
> > ...and how would you guarantee that this setting remains set, in the face
> > of some nasty little cracker screwing around with /dev/kmem?
>
> If the attacker gained the ability to play with /dev/kmem, he can
> already load modules into the kernel, regardless if the kernel is
> actually compiled with module support or not. You can find various
> papers describing how to do it via google, and AFAIK some rootkits are
> already using those techniques, so it's even "scriptkiddy-ready".
Er... that was exactly what I meant - perhaps you meant to reply to the parent
post?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed Jan 23 2002 - 21:00:42 EST