0

I know that ring 0 is a CPU concept, but are processes running as root allowed to run instructions that require ring 0 such as changing the cr3 register for the page table ?

New contributor
hehehe is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

On most modern operating systems, all userspace code runs in ring 3 on x86 and x86-64 CPUs (and similarly for other architectures). Thus, a process running as root cannot perform actions that only ring 0 processes may perform.

However, assuming the system is not using secure boot, it is generally assumed that root can execute arbitrary code in the kernel (by loading kernel modules or modifying /dev/mem, where available) on a Unix system, and so a root-owned process could perform ring 0 behaviors if they wanted to by loading a module or a similar process.

With Secure Boot, this is not supposed to be allowed unless the module is signed with a suitable key, and so assuming you have not signed your module with a machine-owner key, then you'd be prevented from escalating privileges while doing so.

Your Answer

hehehe is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.