Untrusted Root - improve Security by Restricting Root

[Patrick]

@Algernon

Modprobing stuff would be one of the options for a kernel exploit. Certainly not the only one but at least one options less for the attacker.

To use modprobe, root access is required. If malware already has root access, why bother using modprobe?

@Algernon

Edit: We also have apparmor which limits what a user, including root, can do.

If an application runs as root (or any user) under mandatory access control (MAC) such as apparmor or filejail, it cannot use modprobe since MAC would prevent that.

Maybe we have to distinguish between

• a process running as root and MAC,
• “full root compromise”, i.e. a process that runs unconfined (without MAC) as root
• and kernel compromise?

---

The question of this thread is, is the kernel capable to resist full root compromise?