Re: [patch] Add basic sanity checks to the syscall execution patch

[Andi Kleen <andi@firstfloor.org>]

On Thu, Sep 04, 2008 at 01:34:19PM +0100, Alan Cox wrote:
> On Thu, 04 Sep 2008 14:01:46 +0200
> Andi Kleen <andi@firstfloor.org> wrote:
> 
> > Arjan van de Ven <arjan@infradead.org> writes:
> > 
> > > Add basic sanity checks to the syscall execution patch
> > 
> > This just means that the root kits will switch to patch
> > the first instruction of the entry points instead.
> > 
> > So the protection will be zero to minimal, but the overhead will
> > be there forever.
> 
> Agreed entirely. This is a waste of time and a game not worth playing.
> The only place you can expect to make a difference here is in virtualised

Even that can be circumvented by patching indirect pointers (or pointer 
to objects with indirect pointers) in any writable object. Or in
a couple of other ways.

But yes it would still seem like a reasonable useful improvement.

-Andi

-- 
ak@linux.intel.com