2012/3/7 Yao <yffbrave@xxxxxxx>: > (2)the struct "selinux_ops" in file hooks.c is declared as "static", why not > add "const" qualifier so that > the it will be put in read-only data section in the kernel? I probably can. Thanks for the suggestion. > (3)Is there any way to hack the SELinux, I mean, to disable it on the fly? > For example, replace the policy db with a > blank file so that any permission is allowed. Is it feasible? There have been kernel attacks which disable SELinux. If you can write to arbitrary kernel memory you can win. But I'm not going to help tell you how to write your rootkit :) -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@xxxxxxxxxxxxx with the words "unsubscribe selinux" without quotes as the message.
