From owner-freebsd-security  Sun Oct  7 21: 6: 2 2001
Delivered-To: freebsd-security@freebsd.org
Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193])
	by hub.freebsd.org (Postfix) with ESMTP id C4DB037B403
	for <freebsd-security@FreeBSD.ORG>; Sun,  7 Oct 2001 21:05:58 -0700 (PDT)
Received: (from wollman@localhost)
	by khavrinen.lcs.mit.edu (8.11.4/8.11.4) id f9845s529810;
	Mon, 8 Oct 2001 00:05:54 -0400 (EDT)
	(envelope-from wollman)
Date: Mon, 8 Oct 2001 00:05:54 -0400 (EDT)
From: Garrett Wollman <wollman@khavrinen.lcs.mit.edu>
Message-Id: <200110080405.f9845s529810@khavrinen.lcs.mit.edu>
To: Dag-Erling Smorgrav <des@ofug.org>
Cc: freebsd-security@FreeBSD.ORG
Subject: Re: Kernel-loadable Root Kits
In-Reply-To: <xzppu8056xl.fsf@flood.ping.uio.no>
References: <GPEOJKGHAMKFIOMAGMDIGEHGFHAA.deepak_ai.net@ns.sol.net>
	<200109081052.f88AqRG30016@sheol.localdomain>
	<20010908141700.A53738@fump.kawo2.rwth-aachen.de>
	<20010908072542.A57605@sheol.localdomain>
	<20010908143231.A53801@fump.kawo2.rwth-aachen.de>
	<20010908074445.A77252@sheol.localdomain>
	<20010908181537.A840@ringworld.oblivion.bg>
	<20010908102816.B77764@sheol.localdomain>
	<20010908183728.D840@ringworld.oblivion.bg>
	<20010908105308.A78138@sheol.localdomain>
	<20011004023034.U8391@blossom.cjclark.org>
	<xzppu8056xl.fsf@flood.ping.uio.no>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

<<On 07 Oct 2001 07:56:54 +0200, Dag-Erling Smorgrav <des@ofug.org> said:

> "Crist J. Clark" <cristjc@earthlink.net> writes:
>> I went in and made a very simple kernel-build option which disables
>> the use of kldload(2) (and kldunload(2)) at all times.

> # vi /boot/loader.conf
> # shutdown -r now

That's OK -- most people would notice if their machine
``spontaneously'' rebooted.  This isn't Windows, after all.

-GAWollman


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message