Re: Sealing the kernel

[Jesse Pollard <pollard@tomcat.admin.navo.hpc.mil>]

>From: Aaron Sethman <androsyn@atomic-city.dev.powerize.com>
>On Tue, 26 Oct 1999, Dimitris Margaritis wrote:
>> Yes, John forgot to mention that we're assuming boot from a read-only 
>> media such as a write-protected floppy or CD-ROM.  We also assume 
>> that the rc scripts, kernel, and all modules to be loaded at boot 
>> time (before of course the sealing module) also reside on that medium.
>> 
>> About your last point, yes, root can do a lot of nasty things, but by 
>> sealing the kernel at least they are constrained to what's available 
>> through kernel services.  That may help presumably by disabling a lot 
>> of stuff in the running kernel.
>Or even a better idea, compile the kernel without module support all
>together.  Just hope that you don't have any of those blasted Plug and
>Pray devices.

It would be better (in general) to remove root as a privileged user.
Try
	http://www.rsbac.de/rsbac/

for a possible implementation.
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil

Any opinions expressed are solely my own.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/