Re: Save 320K on production machines?

[Linda Walsh <lkml@tlinx.org>]

Andre Tomt wrote:
> Linda Walsh wrote:
> <snip>
>> To minimize
>> problems, I disable unused hardware, and all _used_ hardware
>> is compiled in (no module loading overhead, no chances for
>> arbitrary code insertion).
>
> FYI, rootkits have been able to cope with inserting kernel code 
> without using the modules support for ages. It is only makes it 
> marginally harder.
>
---
    True, but that's the point.  People break into systems with
passwords.  Just because passwords aren't 100% effective in
protecting systems doesn't mean we don't use them.  :-)

    The point is to "minimize" a vulnerability profile.
    I'm wondering why unused code is required to be compiled
in to standard kernels.  It seems very un-linux like -- more like
Windows that has support for everything compiled in.

    Reducing code bloat is not just a good idea for embedded systems.
It's good for performance and security if for no other reason that
there are fewer lines that could go wrong. :-)

-l