| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 8 Mar 2011 07:58:45 +0100 From: Pavel Machek <pavel@....cz> To: "Rafael J. Wysocki" <rjw@...k.pl> Cc: Vasiliy Kulikov <segoon@...nwall.com>, linux-kernel@...r.kernel.org, security@...nel.org, Len Brown <len.brown@...el.com>, linux-pm@...ts.linux-foundation.org Subject: Re: [PATCH] power: disable hibernation if module loading is disabled Hi! > > > modules_disabled surely is not the right interface to disable hibernation > > > and I don't really think there's a bug because it doesn't work as you'd like > > > it to. In fact, there would be a bug if it did work that way. > > > > What do you mean here? Do you agree that you may read kernel image, > > slightly change it (including e.g. possible checksums, I didn't bother > > to check how much one should change), and write it back? > > Yes, you can, but that's not the point. The point is that calling an interface > that disables all possible functionality modifying kernel memory > "modules_disabled" is completely dumb. Sorry, but that's how it goes. Fully agreed. If you want a subset of cap_sys_admin than can't install rootkit... just do it like that. Create cap_small_admin with such subset and migrate people that don't need full admin to it. Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists