unexporting sys_call_table a good idea?
Quoted 8 lines
[...] it is,
rather than being able to simply compile an external module (which disables ptrace) and load it on affected systems, I am forced to recompile an entire kernel, install it on the affected systems, and reboot them all...Thanks,
Paul
This is fallacy. How is exporting syscall table going to help you? You still have to recompile entire kernel, install it on the affected systems, and reboot them all, and only then you can use your module. Wouldn't it be easier just to add a sysctl which disables ptrace, instead?
-- Pete
Quoted 3 lines · Pete Zaitcev
Wouldn't it be easier just to add a sysctl
which disables ptrace, instead?
I have been considering that. I'd suggest this would be more than just a boolean. I could imagine using the lowermost bit to decide if ptrace is allowed for root, and the next bit to decide if ptrace is allowed for other users. But do we really want this sysctl? When do we expect the next root exploit in ptrace?
Signature · 3 lines
Kasper Dupont -- der bruger for meget tid på usenet. For sending spam use mailto:[email protected] for(_=52;_;(_%5)||(_/=5),(_%5)&&(_-=2))putchar(_);