Re:The status of Linux kernel hardening
by cleeus on Thursday November 10, 2016 @04:04AM
(#12918839)
One thing I routinely do is compiling a monolithic kernel without module support (and exactly the modules the hardware needs). This way injecting a module into the kernel should be a little harder.
[ Parent
| on HN ]
Re:The status of Linux kernel hardening
by viraptor on Thursday November 10, 2016 @04:34AM
(#12918985)
On a standard kernel you can still set kernel.modules_disabled=1 after everything you need is loaded. There should be no big difference in behaviour in both cases. Not that the module injection is common anyway...