Re: sebek as a patch?

On Thu, 06 Oct 2005 09:35:48 CDT, Edward Balas said:

> Even if you could present an altered /dev/*mem, the intruder with root
> access can load a kern module which would give them direct access to
> kernel memory, bypassing all of your work. Yeah you could disable the
> install of kernel modules using the technique Thorsten mentioned, but
> that provides a pretty large indicator itself.

And of course, even a kernel built with *no* module support can still have
a module inserted by a sufficiently determined adversary, if they have access
to /dev/*mem: http://www.phrack.org/show.php?p=58&a=7