Re: [PATCH] LSM: add static to security_ops variable

[wzt wzt <wzt.wzt@gmail.com>]

security_ops is not static, so you can find the address with kallsysm,
but you can try secondary_ops:
static struct security_operations *secondary_ops = NULL;

cat /proc/kallsysm|grep secondary_ops

On Fri, Feb 19, 2010 at 8:27 PM, Alexey Dobriyan <adobriyan@gmail.com> wrote:
> On Fri, Feb 19, 2010 at 2:23 PM, wzt wzt <wzt.wzt@gmail.com> wrote:
>>> It's not a barrier, it's garbage. Once you know the adress security_ops
>>> ended up at, you simply write to it.
>>
>> How to find the security_ops address if the variable is static? Would
>> you please make an example?
>
> See /proc/kallsyms .
>
>>> Not that easily, but they still can.
>> That's why i suggest to make the variable to static, if you had wrote
>> a rootkit, you will find that in kernel 2.4.x, there are many many
>> rootkits, but in kernel 2.6.x, rootkit became fewer. Not all the
>> kernel driver writers can master this method to find the variable's
>> address.
>
> Please.
>
>> The patch also delete the secondary_ops variable.
>