Suggestion for Kernel security: BsdGuard

_int2Eh <[email protected]>
Newsgroups gmane.os.freebsd.devel.hackers
Message-ID <CA+5fkdq94WkD_eqOj8VPEZvTJzHKjgpbjBF8whw0qUQ5d4mrHg@mail.gmail.com>
Hey guys!

While testing some things in the FreeBSD Kernel, I saw some functions for
reading and modifying control registers like Cr0, where bit 16 WP ensures
protection of Kernel memory pages against "malicious" writing. Thinking
about this, I had the idea to implement code to act as a Guard in the
FreeBSD Kernel. I named it "BsdGuard". The idea is for it to check
processor registers like Cr0 and even MSRs like LSTAR and verify if these
registers have been compromised for malicious purposes. I already have a
small "layman's" demonstration of the code, which is already running in my
kernel as a module. It's worth noting that, since my studies were all based
on arch AMDx64, I don't know how the implementation would be for other
architectures like "Arm", etc. Anyway, I believe it's a good idea to
implement it in the FreeBSD kernel; I can submit a PR to freebsd/SRC.

Finally, I'm a new contributor and a new FreeBSD user, so please forgive me
if the project itself doesn't focus on this "level of control."
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.