Re: Question about /dev/mem and /dev/kmem

[Wichert Akkerman]

Previously Jim Nelson wrote:
> I was looking at some articles about rootkits on monolithic kernels, and 
> had a thought.  Would a kernel config option to disable write access to 
> /dev/mem and /dev/kmem be a workable idea?

Yes, but not a very useful one since it is an incomplete solution. You
can easily do something better using /proc/kernel/cap-bound (like
writing 0xFFFCFFFF into it).

Wichert.

-- 
Wichert Akkerman <wichert@xxxxxxxxx>    It is simple to make things.
http://www.wiggy.net/                   It is hard to make things simple.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/