Re: malware defense

Peter T. Breuer (ptb@it.uc3m.es)
Mon, 6 Dec 1999 14:51:12 +0100 (MET)


"A month of sundays ago BIONDI Philippe wrote:"
>
> I suggest you to have a glimpse at the LIDS project
> (Linux Intrusion Detection System).
> Its aim is to have an incorruptible kernel (no /dev/kmem, no modules after
> boot time) and then to protect user space entities (like daemons, files,

But this is the wrong way round. I need a kernel that I can verify is
the one I put there and not any simulacron. I.e. I need the kernel
to have compiled into it a secret that allows me to verify it when I
load a verification module.

> Actually, I just remember a mirror address :
> http://www.lids.webmotion.net
> I released an unofficial version last night (which I hope will be soon
> official) which can be found at ftp://ftp.webmotion.net/pub/lids

I'll have a look. Does it address the question above?

Peter

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/