I'm assuming it is possible for an attacker to bypass the Linux kernel to make changes to system memory, hard drives etc.
3
-
2Can you clarify what you're asking exactly? Do you mean bypass security checks built into the kernel?– theterribletriviumJan 1, 2015 at 8:27
-
From my place of ignorance, I'm having trouble expressing what I'm asking exactly. I'm trying to understand the narrowest "choke point" for data access on a Linux system.– KeithJan 1, 2015 at 22:44
-
This question might be better worded: is all access to the underlying system components protected via an access control mechanism managed by the kernel?– SteveJan 2, 2015 at 21:06
Add a comment
|
1 Answer
Both main memory and disk drives are managed solely by the kernel.
For a user space program to access these it needs the kernel's cooperation through the invocation of system calls.
A kernel module can access them without further approval, because it's already part of the kernel. Of course to become a kernel module kernel cooperation is again required.
-
So what's the mechanism that enables the kernel to become the protector? Is there help from the CPU?– KeithJan 1, 2015 at 22:45
-
Yes, typically this kind of access protection is enforced by the CPU on the lowest level. You should read en.wikipedia.org/wiki/… and en.wikipedia.org/wiki/… for details. Jan 2, 2015 at 16:43
-
1