AFAIK for Linux "many eyes" is the only thing protecting people from malicious (and/or buggy) code running at CPL=0 with full access to everything.Solar wrote:Read /usr/src/linux/Documentation/stable_api_nonsense.txt for the official POV of the kernel dev's. In one line, no driver that's not in the kernel repo (i.e., fully disclosed GPL source) will ever be considered, and they think this is a good thing to do.
It doesn't make it necessary to switch ABI, internal architecture etc. on a whim, but if all drives are in the kernel's source code there's no reason not to switch ABI, internal architecture etc. on a whim.Solar wrote:However, I don't see how any of this - even the "all drivers in the kernel" part - makes it necessary to switch ABI, internal architecture etc. on a whim...
...but they aren't, and they won't.Brendan wrote:...but if all drives are in the kernel's source code there's no reason not to switch ABI...
How would the Linux approach help? If you can write a kernel level keylogger you should be able to write a script to compile it automatically on the target's computer with the target's header files and compiler, and that will bypass any "protection".Brendan wrote:Hi,
Pretend for a minute that you're evil, and you want to write a keylogger to steal passwords. My first step would be to think of something people want (e.g. a graphical utility to configure, start, pause and stop virtual machines that supports lots of different VMMs and emulators) and find a believable excuse for this utility to require some sort of kernel module (e.g. to install generic "cross-VMM" TUN/TAP, or to control KVM); and then use the kernel module as a trojan to get the keylogger running.
IMHO there's only 5 approaches to handling this problem:
- The Linux approach: require that all kernel modules are open source (and then complain that hardware manufacturers don't provide open source drivers)
Oh sure there is. Linux drivers break all the time. Imagine if you could just copy over an old version (like using a Windows XP driver on Vista)....but if all drives are in the kernel's source code there's no reason not to switch ABI...
You can't assume every linux box (or in this case any kind of box) will have a compiler on it. Having compilers on production machines is a huge security hole for exactly this reason. I rather dislike that so many linux distros default to installing any development tools. But you're right; if a compiler is available anyone could use it to bypass any protection by compiling a kernel module and loading it. Hopefully in that case, the machine is otherwise locked down pretty well, so remote root access is much harder to come by.Craze Frog wrote:How would the Linux approach help? If you can write a kernel level keylogger you should be able to write a script to compile it automatically on the target's computer with the target's header files and compiler, and that will bypass any "protection".Brendan wrote:Hi,
Pretend for a minute that you're evil, and you want to write a keylogger to steal passwords. My first step would be to think of something people want (e.g. a graphical utility to configure, start, pause and stop virtual machines that supports lots of different VMMs and emulators) and find a believable excuse for this utility to require some sort of kernel module (e.g. to install generic "cross-VMM" TUN/TAP, or to control KVM); and then use the kernel module as a trojan to get the keylogger running.
IMHO there's only 5 approaches to handling this problem:
- The Linux approach: require that all kernel modules are open source (and then complain that hardware manufacturers don't provide open source drivers)
Why is it? if you have access to any account on a machine then you can just as easily wget a copy from somewhere instead of compiling it yourself. Even then, you need root access to modify the kernel in any way (including loading kernel modules or putting them somewhere for the kernel to find).quok wrote:Having compilers on production machines is a huge security hole for exactly this reason.
You're right, an intruder could always just wget a copy. However, security is one of those things that's best done in layers, and a few extra minutes spent by an intruder having to download a compiler could be just the couple of minutes you need to save your machine.Combuster wrote:Why is it? if you have access to any account on a machine then you can just as easily wget a copy from somewhere instead of compiling it yourself. Even then, you need root access to modify the kernel in any way (including loading kernel modules or putting them somewhere for the kernel to find).quok wrote:Having compilers on production machines is a huge security hole for exactly this reason.
Basically, a not installing a compiler is only good enough to save a cracker a few minutes. It doesn't add to security, it doesn't break down on security. And in most instances, it doesn't matter at all.
That said, I once had a distro (SuSe) that did not install a compiler, and did not allow it to be installed either. The result was that the machine was crippled for my server purposes. (More rants on that distro available on request)
