First page Back Continue Last page Summary Graphics
Devices
/dev/mem and /dev/kmem
CAP_SYS_RAWIO required to open
disabled by removing bounding set at boot
- prevents any process from acquiring that capability
- possible honeypot test - may need rethinking
Notes:
Linux provides two devices, /dev/mem and /dev/kmem, that can be used to access kernel memory. Any audit of UML security should examine /proc and /dev for more such files and devices.
In the cases of /dev/mem and /dev/kmem, the CAP_SYS_RAWIO is required in order to open them.
These devices are disabled in 'jail' mode by removing CAP_SYS_RAWIO from the capability bounding set, which is the set of capabilities that any process is ever allowed to have.
Since no process can ever get this capability, /dev/mem and /dev/kmem may never be accessed.
This is a bit heavy-handed, since other useful things may also require CAP_SYS_RAWIO. In limited testing, this has seemed to cause no trouble.
Another problem is that this could be a signature of a honeypot, allowing nasty people to know that they are in a virtual machine.
For these reasons, this mechanism may need to change in the future.