Skip to content

Comment on Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)parent

Comments

Naive question: does Linux check checksum of loaded modules? If not I could just replace them and voila?

What would it be checking against? There's no central signing authority the way there is with Windows. (I mean I guess a distro could implement that but then how would I load my own custom modules?)

The kernel provides the option to embed a signing key for kernel modules at compile time. But (AFAIK) you'll need to compile your own kernel to go that route.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.