From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTP id 2BAE7AEB for ; Tue, 6 May 2014 07:05:56 +0000 (UTC) Received: from mx2.suse.de (cantor2.suse.de [195.135.220.15]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id B30241FC59 for ; Tue, 6 May 2014 07:05:55 +0000 (UTC) Date: Tue, 6 May 2014 09:05:53 +0200 (CEST) From: Jiri Kosina To: Kees Cook In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Cc: ksummit-discuss@lists.linuxfoundation.org Subject: Re: [Ksummit-discuss] [CORE TOPIC] [TECH TOPIC] live kernel patching List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon, 5 May 2014, Kees Cook wrote: > I'm very interested in this, especially as it may relate to security > exploit mitigation work, both in the sense of being able to arbitrarily > patch the kernel against flaws, and to defend against attackers being > able to ... er ... arbitrarily patch the kernel... :) :) Well, for performing the patching, the attacker would either have to be able to modprobe module (kpatch, kgraft, ksplice) or kexec to a new kernel (criu-based solution). In either case, the system would be owned anyway already, independently on any live patching mechanism. -- Jiri Kosina SUSE Labs