4 ms·
Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch
- sour-taste 2y agoDoes anyone know why modprobe_path isn't in read only memory? Would just making it const char be enough to avoid this technique?
- sour-taste 2y agoOh, it's because it can be set by /proc/sys/kernel/modprobe
- rfoo 2y agoThere is CONFIG_STATIC_USERMODEHELPER that disables the sysctl you mentioned and actually make modprobe_path read-only.