3 ms·
Two different considerations for when you'd want to deny memory to other processes: Protecting against outside attackers Digital Rights Management Faking "ms
by Dwedit 2y ago
Two different considerations for when you'd want to deny memory to other processes:
Protecting against outside attackers
Digital Rights Management
Faking "mseal" is something you might intentionally do if you are trying to break DRM, and something you would not want to do if you are trying to defend against outside attackers.
- adrian_b 2y agoThe kernel can bypass any memory protection, it does not need to fake mseal. Controlling the memory protection is one of the most important functions of any OS kernel and one of the few that could not be implemented in any other place. Some CPUs have special hardware means for protecting some memory region against the kernel ("secure enclaves", e.g. Intel SGX), and that is the feature that the supporters of DRM want. "Mseal" is only against attackers who do not control the kernel.