0

I was playing around with /dev/mem and found out that even as root user you cannot access the whole file if CONFIG_STRICT_DEVMEM=y.

It was new to me that there are mechanisms to prevent the root user from doing what he likes.

But as root I could simply alter the Linux kernel image and reboot (to disable the restriction). If the kernel image file is somehow protected I could still write to /dev/sda or whatever the main disk is.

So my question is if settings CONFIG_STRICT_DEVMEM=y is safe or is it easy for the root user to bypass?

2
  • 1
    You cannot protect yourself from the root user unless we are talking about RO storage. CONFIG_STRICT_DEVMEM=y will do absolutely nothing. Oct 2, 2023 at 20:05
  • Security is layers, one single thing can seldom do everything. The system could boot from read-only storage, or have secure mechanisms to only boot a signed kernel. (And if you're lucky, no run-time way to change the boot settings.) In any case, a malware that has to modify the kernel and reboot would be quite a bit more noticeable than one that just silently does its thing.
    – ilkkachu
    Oct 3, 2023 at 7:49

1 Answer 1

2

The purpose of STRICT_DEVMEM isn’t to fully protect the system from its owner, it’s to prevent accidental writes to /dev/mem:

If this option is disabled, you allow userspace (root) access to all of memory, including kernel and userspace memory. Accidental access to this is obviously disastrous, but specific access can be used by people debugging the kernel.

It also makes a number of attack scenarios against the running system more difficult, but it doesn’t protect the system at rest.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .