On Tue, 22 Sep 2009, Jamie Lokier wrote:
Eric Paris wrote:
quoted
That's not the fatal flaw. The fatal flaw is that I am not going to
write 90% of a rootkit and make it easy to use.
I hate to point out the obvious, but fanotify's ability to intercept
every file access and rewrite the file before the access proceeds is
also 90% of a rootkit...
Obvious, but worth noticing.
Indeed, the syscall table has been RO to make it harder for RKs to
exploit it, not to make it impossible. RO syscall table makes perfect
sense.
But, once you are root, with very few lines of code, you can find,
prot-fix the page, and patch the table.
But fortunately both fanotify and syscall rewriting require root in
the first place. ^^^^^^^^^
Again, maybe I wasn't clear about how this would work, but the syscall
table would continue to remain RO ;)
And as I said before, if we want to bring the cost of the interception for
non-users pretty close to zero (a few NOPs to run onto), we could even
adopt an alternative-like patching triggered by a kernel boot option.
- Davide