Re: chkrootkit and LKM?

Valdis.Kletnieks_at_vt.edu
Date: 06/18/03

  • Next message: Taylor, David: "RE: Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log f ile...)" 
    To: Blade Runner <blade@seven.com.br>
Date: Wed, 18 Jun 2003 00:39:53 -0400

    On Tue, 17 Jun 2003 16:47:52 -0300, Blade Runner <blade@seven.com.br> said:

    > If possible, do not allow Loadable module support , maybe this can avoid
    > future problems with lkm.

    Please note that even if the kernel is built without loadable module support,
    it is still possible to insert a module into the kernel - it just requires
    a bit more effort on the part of the programmer.

    Silvio Cesare's paper on doing this:
    http://www.l0t3k.org/biblio/kernel/english/runtime-kernel-kmem-patching.txt

    More than you ever wanted to know:

    http://packetstormsecurity.nl/docs/hack/LKM_HACKING.html

  • Next message: Taylor, David: "RE: Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log f ile...)"

    Relevant Pages

    • Unresolved symbols & kernel mismatch .........
      ... Im new to kernel programming. ... second option of 'Loadable Module Support' in the menuconfig command. ... Due to the compilation problem I feel kernel compilation is more ...
      (comp.os.linux.development.system)
    • Compiling a new kernel: loadable module support
      ... I have a fresh FC1 installation, with kernel 2.4.22. ... Type 'make config' and enable loadable module support. ...
      (comp.os.linux.setup)
    • Trouble with new kernel
      ... I just compiled a new kernel while keeping the old one to fall back on. ... I've compiled a kernel with Loadable module ... support yet it fails to load modules and claims they are not enabled. ...
      (comp.os.linux.misc)
    • Enabling loadable module support in kernel
      ... Is it possible to enable loadable module support in the kernel without ... This is running kernel 2.4.18 or RH8 ...
      (comp.os.linux.setup)
    • Re: OOM killer in 2.6.31-rc2
      ... I had built a 2nd version of the 2.6.31-rc2 kernel last night when I found the ... Normal zone is absent in the above lines. ... More majordomo info at http://vger.kernel.org/majordomo-info.html ...
      (Linux-Kernel)