1

During boot the kernel is loaded into memory and also in-memory filesystems like /proc or /sys are created. How can you change values in those filesystems? Or how could you change the dmesg output, for instance by removing or adding lines? There are some protections in place to prevent writing to kernel memory due to security reasons. Can those be disabled? Ideally nothing should need to run on the system running the kernel itself. Can DMA be used to write kernel memory? Are there other options?

closed as unclear what you're asking by G-Man, Stephen Harris, Rui F Ribeiro, Thomas, Jeff Schaller Jan 19 at 13:37

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • The Linux kernel is open source. I suggest if you want to do those things, you change the source and recompile. Much easier. But maybe you're asking this because you're seeing something weird, or have weird constraints. Could you give a little background? – derobert Jan 18 at 21:29
  • It should be used to protect against reconnaissance even when the system has been totally subverted. There is some stuff in memory which I'd like to prevent from being read or overwrite it with custom values. Examples are mac addresses, dmesg, kernel command line and more. Ideally it should work without recompiling the kernel. I think for VMs the hypervisor could do that to some extend but most relevant stuff happens on bare metal. I came across pcileech: github.com/ufrisk/pcileech and similar DMA attacks which looked promising for this approach. But maybe there are some more options. – user477 Jan 18 at 22:04
  • That's non-trivial, maybe impossible. If totally subverted includes hardware, what stops someone from installing custom DIMMs that just happen to have radios that transmit their contents? (Well, fully encrypted memory, of course, which is offered on some newer CPUs). And what protects against a custom CPU being installed? Etc. – derobert Jan 18 at 22:26
  • Sorry, with fully subverted I mean software level including the kernel. I assume physical security. – user477 Jan 18 at 22:37
  • In that case, the kernel (for example) needs to be able to write to the dmesg ring buffer, or it can't log messages. A subverted kernel would thus be able to as well. Or, probably more importantly, it could simply not write to it, hiding messages that would otherwise reveal the subversion. (You could of course protect lines from before it was subverted simply by copying them to another machine; most syslog implementations can log to a remote machine, for example). – derobert Jan 18 at 22:51