System calls and rootkits

Posted Sep 22, 2008 11:40 UTC (Mon) by robbe (guest, #16131)
In reply to: System calls and rootkits by spender
Parent article: System calls and rootkits

> that exploit I wrote that disabled SELinux.

URL?

> Sorry, but once you compromise the kernel, SELinux is useless.

Nobody will argue that. Not that your parent post talks about "running as
root", not "in the kernel".

to post comments

System calls and rootkits

Posted Sep 22, 2008 20:49 UTC (Mon) by nix (subscriber, #2304) [Link] (1 responses)

If you're root there are a simply enormous number of ways to compromise
the kernel or DoS the box to its knees. Maybe SELinux will eventually be
able to plug them all but it's not there yet.

(I saw one product for Solaris many years ago whose salesman claimed that
it protected the box from denials of service under 'all conditions',
specifically including conditions requiring physical access. I disproved
this bizarreclaim in the obvious way: pulling the plug.)

System calls and rootkits

Posted Jul 22, 2010 0:25 UTC (Thu) by petermag (guest, #7550) [Link]

If u have implement any rootkits, u will know that the best way to do it IS NOT hook at the syscall level (eg, because "sys_read" can be used for so many purposes). Instead, it is much better to do it at the lower level (eg, VFS layer). But if u can hook the syscall table, and so can u unpatch the patch that Arjan has put in to protect the syscall table. And likewise, many other techniques like making the ".text" region read-executable only, is really a joke - because u can easily undo it if u are a rootkit. Eg, ftrace have to make the region writeable momentarily and then switching it back to readonly - exactly the same sequence of steps can be executed by the rootkit kernel module as well. In general "rootkit" means that the system is alreayd 0wned (or compromised). Comments?