4 ms·
OpenBSD does not have loadable kernel modules, so the techniques described for FreeBSD most likely do not apply. As for the Azazel rootkit, it uses LD_PRELOAD.
by marios 13y ago
OpenBSD does not have loadable kernel modules, so the techniques described for FreeBSD most likely do not apply.
As for the Azazel rootkit, it uses LD_PRELOAD. According to the ld.so manpage[1] it is ignored for setuid/setgid executables. This looks like the behaviour is not exactly that of the Linux ld.so so perhaps this limits the rootkit's impact.
[1] http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so§ion=1 http://www.openbsd.org/cgi-bin/man.cgi?query=ld.so§ion=1
- throwaway2048 13y agoopenbsd does have loadable kernel modules http://www.openbsd.org/cgi-bin/man.cgi?query=lkm http://www.openbsd.org/cgi-bin/man.cgi?query=lkm LD_PRELOAD and friends are also ignored on linux for setuid/setgid binaries, otherwise privilege escalation would be trivial, just start any dynamicly linked setuid binary with LD_PRELOAD and go to town.
- dmm 13y agoOpenBSD's kernel modules are for development only. They require a securelevel change and a reboot to enable.