From owner-freebsd-security Thu Dec 21 10:58: 0 2000 From owner-freebsd-security@FreeBSD.ORG Thu Dec 21 10:57:59 2000 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by hub.freebsd.org (Postfix) with ESMTP id 1B17737B400; Thu, 21 Dec 2000 10:57:58 -0800 (PST) Received: (from des@localhost) by flood.ping.uio.no (8.9.3/8.9.3) id TAA13653; Thu, 21 Dec 2000 19:57:56 +0100 (CET) (envelope-from des@ofug.org) Sender: des@ofug.org X-URL: http://www.ofug.org/~des/ X-Disclaimer: The views expressed in this message do not necessarily coincide with those of any organisation or company with which I am or have been affiliated. To: Kris Kennaway Cc: Mikhail Kruk , "Michael A. Williams" , security@FreeBSD.ORG Subject: Re: Read-Only Filesystems References: <20001221064842.B27118@citusc.usc.edu> <20001221084452.A28157@citusc.usc.edu> From: Dag-Erling Smorgrav Date: 21 Dec 2000 19:57:55 +0100 In-Reply-To: Kris Kennaway's message of "Thu, 21 Dec 2000 08:44:52 -0800" Message-ID: Lines: 16 User-Agent: Gnus/5.0802 (Gnus v5.8.2) Emacs/20.4 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Kris Kennaway writes: > On Thu, Dec 21, 2000 at 11:39:56AM -0500, Mikhail Kruk wrote: > > Kris Kennaway writes: > > > Correct, but if they're not noschg then you can trivially trojan a > > > kernel module which you know is loaded at boot time. [...] > > wait, but can't you make kernel modules and startup scripts noschg too? > Go back and read the first paragraph above. It's theoretically > possible, but the list of things you would have to noschg is huge, > constantly changing from version to version, and not completely known. Umm, people, please, "schg" not "noschg". If you find this confusing, use "simmutable" instead. DES -- Dag-Erling Smorgrav - des@ofug.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message