3 ms·
I'm not sure what protection you could expect on any system where the kernel has been replaced by the attacker. Sure they can bypass mseal, but they are also b
by jandrese 2y ago
I'm not sure what protection you could expect on any system where the kernel has been replaced by the attacker. Sure they can bypass mseal, but they are also bypassing all other security on the box.
- Dwedit 2y agoTwo different considerations for when you'd want to deny memory to other processes: Protecting against outside attackers Digital Rights Management Faking "mseal" is something you might intentionally do if you are trying to break DRM, and something you would not want to do if you are trying to defend against outside attackers.
- adrian_b 2y agoThe kernel can bypass any memory protection, it does not need to fake mseal. Controlling the memory protection is one of the most important functions of any OS kernel and one of the few that could not be implemented in any other place. Some CPUs have special hardware means for protecting some memory region against the kernel ("secure enclaves", e.g. Intel SGX), and that is the feature that the supporters of DRM want. "Mseal" is only against attackers who do not control the kernel.