On Sat, Feb 17, 2018 at 7:22 AM, Ahmed Soliman <ahmedsoliman0x666@xxxxxxxxx> wrote: > well in this case I tried searching and researching more and I found > the idea for Rootkit blocking using KVM virtualization, it is > described here: > https://kernelnewbies.org/KernelProjects/VirtRootkitBlocker I think it's good to experiment with kernel hardening via hypervisors. There isn't any particular direction defined for this approach, with lots of different things getting tried (e.g. Samsung KNOX). One problem with the hypervisor-control of memory protections is things like kprobes, modules, etc, that need to do dynamic rewriting of kernel text. > I CCed to riel > It took me a while to re-learn how to setup kernel developing > environment, via buildroot for generating qemu > images for paravirtualized OS debugging, and learning about mm and KVM (WIP). > I am not sure if this is the right place but I think anti rootkits can > be good hardening technique, I made sure > that no one is working on this (no patches anywhere), and my > team-mates are happy with the idea so I hope we are > ready to start. Just in case anyone tries to drift me off the idea, I > do like it enough so I already talked to my professor > and my team-mates about it. I just wanted to know which tree should I > be working on, should it be the kernel hardening > tree or the tree used for kvm or memory management. I would develop against Linus's latest release tag (e.g. currently v4.15), unless you have some overwhelming reason to base on a subsystem tree. -Kees -- Kees Cook Pixel Security
