Re: MAC: request MODIFY_SYSTEM_DATA, target NETDEV
Javier J. Martínez Cabezón <[email protected]>
| Newsgroups | gmane.linux.rsbac |
|---|---|
| Message-ID | <[email protected]> |
I started one mail-thread about the restrictions of /dev/mem, I will continue there. 2009/1/15 Javier J. Martínez Cabezón <[email protected]>: > PaX developer doesn't seem to trust very much in it: > http://archives.gentoo.org/gentoo-hardened/msg_7f2f9778ecc682c622be1ac7c97600fe.xml > :-S > > 2009/1/15 Amon Ott <[email protected]>: >> Am Dunnersdag 15 Januor 2009 schrieb Javier J. Martínez Cabezón: >>> why DAZ in a linux desktop?, I thought that DAZ were useful for >>> example in mail servers. Do you consider malware a treat in (even) a >>> standard linux?. >>> I think that DAZ imposes a too high overhead to a desktop system, I >>> would not switch it on. >> >> We use it to check files before they get transferred to Windows clients. >> >>> The problem in his setup I think is X-org, xorg has CAP_SYS_RAWIO and >>> if rsbac can't control which addresses in /dev/mem can't it reach I >>> think that not setup is useful. Have we something like grsecurity that >>> only memory video could it be reach? >> >> The standard 2.6 kernel has such restrictions on board: >> >> Kernel Hacking -> Filter Access to /dev/mem >> >> I strongly recommend to turn that on, even if only X can access /dev/mem with >> RSBAC. :) >> >> Amon. >> -- >> http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22 >> _______________________________________________ >> rsbac mailing list >> [email protected] >> http://www.rsbac.org/mailman/listinfo/rsbac >> >