From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S262874AbVGAVTN (ORCPT ); Fri, 1 Jul 2005 17:19:13 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S262969AbVGAVRn (ORCPT ); Fri, 1 Jul 2005 17:17:43 -0400 Received: from clock-tower.bc.nu ([81.2.110.250]:47754 "EHLO lxorguk.ukuu.org.uk") by vger.kernel.org with ESMTP id S261576AbVGAVRI (ORCPT ); Fri, 1 Jul 2005 17:17:08 -0400 Subject: Re: [PATCH] Read only syscall tables for x86_64 and i386 From: Alan Cox To: linux-os@analogic.com Cc: Andi Kleen , Christoph Lameter , Linux Kernel Mailing List In-Reply-To: References: <20050629024903.GA21575@bragg.suse.de> <20050701202805.GF21330@wotan.suse.de> Content-Type: text/plain Content-Transfer-Encoding: 7bit Message-Id: <1120252438.15069.55.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 (1.4.6-2) Date: Fri, 01 Jul 2005 22:13:59 +0100 Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org On Gwe, 2005-07-01 at 21:47, Richard B. Johnson wrote: > After all modules are loaded, you (startup) loads a module that > makes the module-loader stuff return -ENOSYS. Then, nobody can > load any new modules. The running kernel is (more) secure. Just use an SELinux policy like everyone else 8). You need to block more otherwise I can load a module by hand through /dev/mem etc Alan -- " If knowledge does not have owners, then intellectual property is a trap set by neo-liberalism." -- Hugo Chavez