Re: Automatic Configuration of a Kernel

[Nix <nix@esperi.org.uk>]

On Thu, 15 Sep 2005, Valdis Kletnieks murmured woefully:
> 1) This patch is pointless without other kernel magic to guarantee that
> even root can't open /dev/kmem - either SELinux and/or the 'devmem.patch'
> that's in current Fedora kernels.  There's well-known ways to do the equivalent of
> an insmod even if the kernel is built with 'CONFIG_MODULES=n'.

Agreed; I use it in conjunction with a one-liner to remove CAP_RAWIO
from the capability bounding set.

> 2) Guess it's time to re-post my sysctl patch to provide a general-purpose
> one-shot... (Diffed against 2.6.11-mm4, but applies cleanly to 2.6.13-mm1 as well).

Yes, much nicer. (My goal, to get a better patch by posting my ugly one,
is achieved! ;) )

-- 
`One cannot, after all, be expected to read every single word
 of a book whose author one wishes to insult.' --- Richard Dawkins