From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: Hello world! Student interested in getting involved. Date: Wed, 21 Feb 2018 13:44:27 -0800 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Cc: Ard Biesheuvel , Rik van Riel , KVM , Kernel Hardening To: Ahmed Soliman Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Sender: keescook@google.com In-Reply-To: List-Id: kvm.vger.kernel.org On Sat, Feb 17, 2018 at 7:22 AM, Ahmed Soliman wrote: > well in this case I tried searching and researching more and I found > the idea for Rootkit blocking using KVM virtualization, it is > described here: > https://kernelnewbies.org/KernelProjects/VirtRootkitBlocker I think it's good to experiment with kernel hardening via hypervisors. There isn't any particular direction defined for this approach, with lots of different things getting tried (e.g. Samsung KNOX). One problem with the hypervisor-control of memory protections is things like kprobes, modules, etc, that need to do dynamic rewriting of kernel text. > I CCed to riel > It took me a while to re-learn how to setup kernel developing > environment, via buildroot for generating qemu > images for paravirtualized OS debugging, and learning about mm and KVM (WIP). > I am not sure if this is the right place but I think anti rootkits can > be good hardening technique, I made sure > that no one is working on this (no patches anywhere), and my > team-mates are happy with the idea so I hope we are > ready to start. Just in case anyone tries to drift me off the idea, I > do like it enough so I already talked to my professor > and my team-mates about it. I just wanted to know which tree should I > be working on, should it be the kernel hardening > tree or the tree used for kvm or memory management. I would develop against Linus's latest release tag (e.g. currently v4.15), unless you have some overwhelming reason to base on a subsystem tree. -Kees -- Kees Cook Pixel Security