4 ms·
There's a school of thought in security that believes you should hard fail at any attempt to violate an invariant. I believe the linux grsec patches do this. Th
by shanemhansen 10y ago
There's a school of thought in security that believes you should hard fail at any attempt to violate an invariant. I believe the linux grsec patches do this. They will just crash the kernel if they see something at runtime that they don't like.
- aaronmdjones 10y agoIndeed; if you have the Active Kernel Exploit Response feature enabled in grsec, and a root process triggers a kernel OOPS, it will panic() the kernel. You can combine this with the panic= kernel command-line argument to set a reboot delay, but for headed (rather than headless) boxes it may be more desirable to keep the panic message up to see what process triggered it.