Ksplice: kernel patches without reboots [LWN.net]

Ksplice: kernel patches without reboots

Posted Apr 30, 2008 10:00 UTC (Wed) by dambacher (subscriber, #1710)
Parent article: Ksplice: kernel patches without reboots

what if someone provides a patch to silently _include_ a security hole? 
How can a sysadmin make sure his kernel won't be patched that way?

(Log in to post comments)

Ksplice: kernel patches without reboots

Posted Apr 30, 2008 11:16 UTC (Wed) by nowster (subscriber, #67) [Link]

The black hats have already done this. Modules that patch the kernel have been part of
rootkits for a while.

Ksplice: kernel patches without reboots

Posted Apr 30, 2008 12:24 UTC (Wed) by nix (subscriber, #2304) [Link]

Don't allow module loading and remove CAP_SYS_RAWIO from the capability bounding set so that
use of /dev/mem, /dev/kmem et al is barred.

(Of course this stops you using ksplice, systemtap et al as well.)