0

I know that ring 0 is a CPU concept, but are processes running as root allowed to run instructions that require ring 0 such as changing the cr3 register for the page table ?

0

On most modern operating systems, all userspace code runs in ring 3 on x86 and x86-64 CPUs (and similarly for other architectures). Thus, a process running as root cannot perform actions that only ring 0 processes may perform.

However, assuming the system is not using secure boot, it is generally assumed that root can execute arbitrary code in the kernel (by loading kernel modules or modifying /dev/mem, where available) on a Unix system, and so a root-owned process could perform ring 0 behaviors if they wanted to by loading a module or a similar process.

With Secure Boot, this is not supposed to be allowed unless the module is signed with a suitable key, and so assuming you have not signed your module with a machine-owner key, then you'd be prevented from escalating privileges while doing so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.