3 ms·
Probably not LD_PRELOAD. It would need to be an imported function in order for LD_PRELOAD to have any effect. A raw syscall would not be interceptable that wa
by Dwedit 2y ago
Probably not LD_PRELOAD. It would need to be an imported function in order for LD_PRELOAD to have any effect. A raw syscall would not be interceptable that way.
Discussion about intercepting linux syscalls: https://stackoverflow.com/questions/69859/how-could-i-intercept-linux-sys-calls https://stackoverflow.com/questions/69859/how-could-i-interc...
But building your own patched kernel that pretends that mseal works would be the simplest way to "disable" that feature. Programs that use mseal could still do sanity checks to see if mseal actually works or not. Then a compromised kernel would need secret ways to disable mseal after it has been applied, to stop the apps from checking for a non-functional mseal.
- jandrese 2y agoI'm not sure what protection you could expect on any system where the kernel has been replaced by the attacker. Sure they can bypass mseal, but they are also bypassing all other security on the box.
- Dwedit 2y agoTwo different considerations for when you'd want to deny memory to other processes: Protecting against outside attackers Digital Rights Management Faking "mseal" is something you might intentionally do if you are trying to break DRM, and something you would not want to do if you are trying to defend against outside attackers.
- adrian_b 2y agoThe kernel can bypass any memory protection, it does not need to fake mseal. Controlling the memory protection is one of the most important functions of any OS kernel and one of the few that could not be implemented in any other place. Some CPUs have special hardware means for protecting some memory region against the kernel ("secure enclaves", e.g. Intel SGX), and that is the feature that the supporters of DRM want. "Mseal" is only against attackers who do not control the kernel.