From owner-freebsd-security Thu Mar 11 16:20:35 1999 Delivered-To: freebsd-security@freebsd.org Received: from goliath.camtech.net.au (goliath.camtech.net.au [203.5.73.2]) by hub.freebsd.org (Postfix) with ESMTP id D8C73152F6 for ; Thu, 11 Mar 1999 16:20:08 -0800 (PST) (envelope-from newton@camtech.com.au) Received: from sebastion.sa.camtech.com.au (sebastion.sa.camtech.com.au [203.28.3.2]) by goliath.camtech.net.au (8.8.5/8.8.2) with ESMTP id KAA12564; Fri, 12 Mar 1999 10:48:23 +1030 (CST) Received: (from smtp@localhost) by sebastion.sa.camtech.com.au (8.8.5/8.8.7) id KAA10509; Fri, 12 Mar 1999 10:49:27 +1030 (CST) Received: from slingshot(192.168.1.2) by sebastion via smap (V2.0) id xma010489; Fri, 12 Mar 99 10:49:10 +1030 Received: from frenzy.ct (newton@frenzy.ct [192.168.4.65]) by slingshot.ct (8.9.1/8.9.1) with ESMTP id KAA28134; Fri, 12 Mar 1999 10:49:07 +1030 (CST) From: Mark Newton Received: (from newton@localhost) by frenzy.ct (8.8.8/8.8.8) id KAA05025; Fri, 12 Mar 1999 10:49:07 +1030 (CDT) Message-Id: <199903120019.KAA05025@frenzy.ct> Subject: Re: FreeBSD SKIP port updated In-Reply-To: <199903120015.QAA99619@bubba.whistle.com> from Archie Cobbs at "Mar 11, 99 04:15:04 pm" To: archie@whistle.com (Archie Cobbs) Date: Fri, 12 Mar 1999 10:49:07 +1030 (CDT) Cc: newton@camtech.com.au, ark@eltex.ru, freebsd-security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL32 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Archie Cobbs wrote: > Mark Newton writes: > > > > I am curious if someone tried to update it to compile in-kernel. > > > > I don't use LKMs, i have them disabled for security reasons (no flames > > > > please) > > > > > > Well, there's no reason you couldn't load it at boot time. > > > Ie, add it to boot.conf (or loader.conf of whatever it's called). > > > > If you have KLDs disabled that shouldn't work (and it represents a > > pretty major security issue if it does!) > > I thought the disabling of KLD's only blocked the kldload() process. > Guess not. From a brief look at the source, you might be right. This is bad. I'd think disabling KLDs should totally disable the in-kernel linker. Otherwise someone could get new modules into your kernel by adding 'em to loader.rc and forcing a reboot. - mark --- Mark Newton Email: newton@camtech.com.au Systems Engineer and Senior Trainer Phone: +61-8-8303-3300 Camtech (SA), a member of the Fax: +61-8-8303-4403 CAMTECH group of companies WWW: http://www.camtech.com.au To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message