Re: Checking integrity of /sbin/init from within kernel

[Jan Wildeboer <jan.wildeboer@gmx.de>]

Torsten Valentin wrote:

> For my purposes and in my scenario it will improve security.

It will not. If there is a risk of someone taking your server offline, 
opening the case, getting the HD out, modify the contents, put it back 
in the case, getting it back online without anyone noticing you have a 
lot of other problems ;-)

> My method
> is to give the kernel a new variable with a signature in it that I have
> created before compiling my /sbin/init. Then I make my /sbin/init so
> that it checks for the signature in the kernel (similar to `sysclt
> kern.mysignature`). If the signature is correct, we are running "my"
> kernel.

That will only work if the signature is stored in a secure place. If it 
is on the same HD it is not secure. I could update the signature before 
putting the HD back.

> I think it's a huge improvement in security!

I think it's not ;-)

Jan Wildeboer