Comment on Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)parentComments−worthless-trash8moOr only allow signed kernel modules. Aka secure boot.This doesn't solve all vectors but afaics this will prevent non signed modules from loading.
Comments
Or only allow signed kernel modules. Aka secure boot.
This doesn't solve all vectors but afaics this will prevent non signed modules from loading.