It's worth noting that even if you disabled
/dev/kmem that memory can still be dumped; take a look at
man proc to reveal
/proc/kcore; it is the systems physical memory. A really good forensics toolkit rekall has a tool that does this already; it dumps the memory (and
/boot files) so that they can be analyzed.
As a matter of fact, Ubuntu by default disables
There is no modern use of
/dev/kmem any more beyond attackers using it to load kernel rootkits.
CONFIG_DEVKMEM is set to "n". While the
/dev/kmem device node still exists in Ubuntu 8.04 LTS through Ubuntu 9.04, it is not actually attached to anything in the kernel.
Ubuntu doesn't disable
/dev/mem because its needed by applications.
Some applications (Xorg) need direct access to the physical memory from user-space. The special file
/dev/mem exists to provide this access. In the past, it was possible to view and change kernel memory from this file if an attacker had root access. The
CONFIG_STRICT_DEVMEM kernel option was introduced to block non-device memory access (originally named
How to disable
Do not enable
CONFIG_PROC_KCORE when building the kernel.
How do you disable
Well, looking over
man mem gives us some details about how its created:
mknod -m 660 /dev/mem c 1 1
chown root:kmem /dev/mem
You should be able to just
rm -rf /dev/mem; you can disable during kernel build phase by not enabling
How to disable
CONFIG_DEVKMEM is not enabled upon kernel build.
How to prevent cold-boot attacks?
What if I was able to disable
/dev/kmem and then used an encrypted swap partition or didn't use swap at all? Well, your memory could just be freezed and accessed that way. How do you prevent this attack? You encrypt your RAM; how do you encrypt your RAM? You can't. See TRESOR for details.