| |||||||||||||
Allowed modules listAllowed modules listPosted Mar 18, 2004 9:22 UTC (Thu) by eru (subscriber, #2753)In reply to: Allowed modules list by corbet Parent article: A new Adore root kit If you're really concerned, a better solution is to link everything you need into your kernel and disallow modules altogether. But I recall that some time ago LWN (or possibly some other Linux web page, not sure) reported discussions among kernel developers about deprecating the making of statical kernels altogether. Did that already happen with 2.6? Is it likely to happen? Anyway, this solution is not quite feasible for most ordinary users: configuring the kernel with its hundreds of options is tedious, and I have found it can be difficult to decide what drivers or features can be disabled safely. The result is also less flexible when new hardware is installed. So I do not think the statical kernel a very practical solution for most users. Other alternatives are needed for securing against rootkit modules..
(Log in to post comments)
Allowed modules list Posted Mar 18, 2004 11:31 UTC (Thu) by nix (subscriber, #2304) [Link] Anyway, this solution is not quite feasible for most ordinary users: configuring the kernel with its hundreds of options is tedious, and I have found it can be difficult to decide what drivers or features can be disabled safely. The result is also less flexible when new hardware is installed. So I do not think the statical kernel a very practical solution for most users.This may well be true for general-purpose systems (although I haven't found it so), but firewalls, at least, can run with module support removed (no matter what their hardware: if necessary, run the firewall as a UML instance with no module support. UML's not *quite* secure, and won't be until lcall syscalls can be virtualized, but it's damned close.)
|
|||||||||||||