From owner-freebsd-security Mon Jul 12 6:55:20 1999 Delivered-To: freebsd-security@freebsd.org Received: from critter.freebsd.dk (critter.freebsd.dk [212.242.40.131]) by hub.freebsd.org (Postfix) with ESMTP id EACAA14C30 for ; Mon, 12 Jul 1999 06:55:16 -0700 (PDT) (envelope-from phk@critter.freebsd.dk) Received: from critter.freebsd.dk (localhost [127.0.0.1]) by critter.freebsd.dk (8.9.3/8.9.2) with ESMTP id PAA19300; Mon, 12 Jul 1999 15:54:05 +0200 (CEST) (envelope-from phk@critter.freebsd.dk) To: Peter Wemm Cc: Darren Reed , des@flood.ping.uio.no (Dag-Erling Smorgrav), security@FreeBSD.org Subject: Re: Module magic In-reply-to: Your message of "Mon, 12 Jul 1999 16:58:57 +0800." <19990712085857.2B14C8A@overcee.netplex.com.au> Date: Mon, 12 Jul 1999 15:54:05 +0200 Message-ID: <19298.931787645@critter.freebsd.dk> From: Poul-Henning Kamp Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org In message <19990712085857.2B14C8A@overcee.netplex.com.au>, Peter Wemm writes: >Darren Reed wrote: >> In some mail from Dag-Erling Smorgrav, sie said: >> > >> > Thought this'd be of interest to this list: >> > >> > http://thc.pimmel.com/files/thc/bsdkern.html >> >> So what ? >> >> Nothing in that document is "new" although it might be the >> first time it's been documented for script-kiddies. > >Yeah, the main worrying thing about it is the hard coding of internal data >structures and bypassing of proper interfaces. I'm half thinking about >doing a couple of arbitary rearrangements of some internal (opaque) data >structures to make their life a bit more exciting. I'd rather a box panic >and burn if a script kiddie gets in and tries to use some of these >``techniques'' than have it run whatever they like undetected. This will >be totally harmless to the existing modules since the data structures are >not used outside kern_*.c. Hmm, here's a thought: We have many structures where the order of elements isn't that important, so somebody write a perl script which looks for some magic marking (or reads a config file) for which fields are legal game, and rearranges them in /sys/sys before each recompile of the kernel .1 * :-) -- Poul-Henning Kamp FreeBSD coreteam member phk@FreeBSD.ORG "Real hackers run -current on their laptop." FreeBSD -- It will take a long time before progress goes too far! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message