Re: [RFC][PATCH] Randomize kernel base address on boot

Ingo Molnar
2011-05-27T09:39:12Z

* Vivek Goyal <vgoyal@redhat.com> wrote:

> > Is it common to run kexec-tools as non-root? It may be necessary
> > to restrict this interface to root when randomization is used
> > (keep in mind nobody's going to force you to turn this on by
> > default, at least for the foreseeable future).
>
> kexec-tools runs as root. And I see that /proc/iomem permissions
> are also for root only. So it probably is a non-issue.

it might be an issue to keep in mind for later projects that try to
lock down root itself from being able to patch the kernel (other than
rebooting the box), using signed modules, disabled direct-ioport
access, and other hardened facilities.

Thanks,

Ingo