Linus Torvalds Approves New Kernel 'Lockdown' Feature

'"After years of countless reviews, discussions, and code rewrites,
Linus Torvalds approved on Saturday a new security feature for the
Linux kernel, named 'lockdown'," reports ZDNet:

The new feature will ship as a LSM (Linux Security Module) in the
soon-to-be-released Linux kernel 5.4 branch, where it will be turned
off by default; usage being optional due to the risk of breaking
existing systems. The new feature's primary function will be to
strengthen the divide between userland processes and kernel code by
preventing even the root account from interacting with kernel code --
something that it's been able to do, by design, until now.

When enabled, the new "lockdown" feature will restrict some kernel
functionality, even for the root user, making it harder for
compromised root accounts to compromise the rest of the OS... "When
enabled, various pieces of kernel functionality are restricted," said
Linus Torvalds, Linux kernel creator, and the one who put the final
stamp of approval on the module yesterday. This includes restricting
access to kernel features that may allow arbitrary code execution via
code supplied by userland processes; blocking processes from writing
or reading /dev/mem and /dev/kmem memory; block access to opening
/dev/port to prevent raw port access; enforcing kernel module
signatures; and many more others, detailed here.'

-- source: https://linux.slashdot.org/story/19/09/30/0312211

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz