So, would it be feasible to make it possible to disable direct hardware
access (/dev/mem, /dev/nvram, HD ioctls, what else?) completely in kernel
config? Or are some of those always needed? If not, then they could be
disabled (do not enable what you don't need, as with /etc/inetd) on a
trivial web server box, route, firewall etc. Of course, kernel module
loading should be disabled as well (or made available only via
challange-response authentication or something (*)). Make your boot media
read-only, and the cracker shouldn't be able to change the kernel either.
Which applications need (dangerous) direct hardware access? In which cases
would it be possible to disable it? You can't propably shield your monitor
if you want to run X, but for server boxes, that's not a big deal.
If nothing else, people running honey pot boxes to attract crackers would
propably want to use this.
Or is this a completely dead idea?
-- v --
(*) Publib key in kernel, private key held separately by the
administrator. Without writable /dev/mem (etc) this should work?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/