3 ms·
> I'm pretty sure Linux kernel modules can't easily do that. They can, and rootkits in the past (unsurprisingly) have. But that's just technical ability; users
by pritambaral 8y ago
> I'm pretty sure Linux kernel modules can't easily do that.
They can, and rootkits in the past (unsurprisingly) have. But that's just technical ability; users willing to run things like that is a whole different matter, especially when we can just namespace and/or sandbox apps.
- jchw 8y agoI'm not so surprised that rootkits can exist on Linux, but I was under the impression the Linux kernel made it much harder to break out of the framework provided and patch over whatever you wanted. Sure, it's all Ring 0, but there's kASLR and you have limited visibility, maybe not even a map of symbols. Is it still possible to do this kind of attack today?
- pritambaral 8y agoEverything running in kernel-space is fully trusted (talking about code compiled and linked against the kernel, not JITted code running in a VM). Symbol map may or may not be built and/or exported during build (both defaulting to true on Debian/Ubuntu setups).