Date: Tue, 14 Aug 2007 18:48:16 +0100
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: Hajime Inoue <hinoue@ccsl.carleton.ca>
Cc: linux-kernel@vger.kernel.org
Subject: Re: System call interposition/unprotecting the table
Message-ID: <20070814184816.12a8a94c@the-village.bc.nu>
In-Reply-To: <46C1E5F5.9050702@ccsl.carleton.ca>
References: <20070813180535.vo36rcevi80s0c4c@www.ccsl.carleton.ca>
	<20070814000956.7c8929dd@the-village.bc.nu>
	<46C1E5F5.9050702@ccsl.carleton.ca>
Organization: Red Hat UK Cyf., Amberley Place, 107-111 Peascod Street,
 Windsor, Berkshire, SL4 1TE, Y Deyrnas Gyfunol. Cofrestrwyd yng Nghymru a
 Lloegr o'r rhif cofrestru 3798903
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1212
Lines: 27

> Just protecting the table does not stop rootkits.  A highly referenced
> phrack article explains how to bypass the table.  

But most people are not capable of fllowing that article - or they
wouldn't be asking here whatever their intention.

> Why isn't the rest of the kernel code protected along with the table?

Thats in progress actually and hopefully then in the hypervisor case
implementing irrevocably read-only pages.

> Finally, system call interposition is used in several interesting
> systems, most notably, systrace.  It's unclear to me how one would
> implement something like systrace without modifying the table or doing
> other rootkit-like antics.

Always wrongly. You can't be sure the table format will not change, you
can't reliably restore the table and its virtually impossible to do any
kind of trace reliably this way as you end up with two copies of the data
from user space which may vary (and leads to bad problems - see BSD
recently).

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/