how to enable "Runtime module disabling" in Custom config ?
Posted:
Sat Jul 23, 2011 8:25 pmby perlish
I thought "Runtime module disabling" is a cool stuff to avoid LKM rootkit,but how can I enable it in Custom config ?
Re: how to enable "Runtime module disabling" in Custom confi
Posted:
Mon Jul 25, 2011 12:48 amby perlish
modules_disabled can be set in the rc.local or sysctl.conf.
We can make sure that lkm rootkit must load after the modules_disable turning on ?
if the hacker use adore-ng to relink some modules,I guess the adore-ng can load successful.
Re: how to enable "Runtime module disabling" in Custom confi
Posted:
Mon Jul 25, 2011 7:58 amby spender
They can also modify the kernel to backdoor the system on the next reboot. The feature in mainline is essentially the same as the one I had: it only prevents loading modules after the point you specify, until a reboot. If being able to load modules at all is a problem, then just disable module support. Otherwise, you need to be using RBAC.
-Brad