[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20040312221923.GF24481@openwall.com>
Date: Sat, 13 Mar 2004 01:19:23 +0300
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: Re: modules on the CD - yet another question
On Fri, Mar 12, 2004 at 08:53:28AM +0100, m.siennicki@...os.pl wrote:
> Then maybe there is enough room to add just BusLogic support
> (for VMware)?
Is that CONFIG_SCSI_BUSLOGIC?
Why does VMware require it?
> And just one more off-topic question (I'm interested what others
> think about it):
> Isn't a kernel with modules support disabled more secure then
> a kernel with the support enabled?
Well, if you want my opinion:
Yes, but very slightly. There're two reasons why this might make a
kernel a little more secure: this makes it somewhat harder to reliably
install kernel-level backdoors and reduces kernel code size thereby
potentially reducing the number of bugs there might be. (Of course,
this assumes that you do not compile in extra/unneeded functionality
"just in case" simply because you have disabled module support.)
But in practice, it was only the first factor which mattered some
years ago (at around 1997-1999 when lkm-based rootkits for Linux
already existed, but kmem-based ones did not), and the point is moot
these days with the widespread kmem-based rootkits. (Yes, it is
possible to patch the kernel to make kmem read-only, forcing rootkits
to resort to even more complicated and less reliable tricks.)
--
/sd
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
