Suggestion for Kernel security: BsdGuard
_int2Eh <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.hackers |
|---|---|
| Message-ID | <CA+5fkdq94WkD_eqOj8VPEZvTJzHKjgpbjBF8whw0qUQ5d4mrHg@mail.gmail.com> |
Hey guys! While testing some things in the FreeBSD Kernel, I saw some functions for reading and modifying control registers like Cr0, where bit 16 WP ensures protection of Kernel memory pages against "malicious" writing. Thinking about this, I had the idea to implement code to act as a Guard in the FreeBSD Kernel. I named it "BsdGuard". The idea is for it to check processor registers like Cr0 and even MSRs like LSTAR and verify if these registers have been compromised for malicious purposes. I already have a small "layman's" demonstration of the code, which is already running in my kernel as a module. It's worth noting that, since my studies were all based on arch AMDx64, I don't know how the implementation would be for other architectures like "Arm", etc. Anyway, I believe it's a good idea to implement it in the FreeBSD kernel; I can submit a PR to freebsd/SRC. Finally, I'm a new contributor and a new FreeBSD user, so please forgive me if the project itself doesn't focus on this "level of control."