[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Checking integrity of /sbin/init from within kernel



Is it possible to access a file (/sbin/init) from the kernel and check
it's integrity? I've been told that accessing a file directly from the
kernel is something ranging from very hard to impossible. Is this true?
If not, how could this be achieved? 

Myself, I'm no programmer capable to work on kernel code, so is there
someone I could ask to implement this for me? If not on this list, who
could I contact? In my eyes an easy (and insecure) file integrity check
like CRC would be sufficient for me, obviously an md5 check would be
better.

The reason for my question is the following:

I want to assure that /sbin/init has not been changed for security
reasons. If the integrity check fails, the kernel should stop and not
start /sbin/init after bootup.

I am working on a project where security is a very high priority and it
is imaginable that unprivileged people may lay hand on the filesystem
(by taking the hd, mounting it into another system and putting their
backdoors or whatever into the system). My /sbin/init makes integrity
checks of the used programs, but /sbin/init cannot yet be checked for
integrity itself. Therefore it would be a perfect solution if there was
a way to build e.g. an md5-sum of /sbin/init by hand and paste it into
some kernel-config file and rebuild the kernel. The kernel should boot
up normally and then check /sbin/init's md5-sum before executing it. If
it's not correct, the kernel should just say some debug message and
stop.

Is that possible?

T.