Ask the Expert

Built-in mechanisms for securing the kernel

Other than SELinux or similar frameworks, what built-in mechanisms exist for securing Linux Kernel? What changes are made in source code?

    Requires Free Membership to View

There are a number of tools that can further secure the Linux kernel. OpenWall, LIDS and Pax/grsecurity are all examples of modules that can be compiled into the kernel to perform this function. The changes they make to the source code greatly vary depending on the function of the tool. Some of the functions that kernel security modules introduce include Role-Based Access Control (RBAC), chrooting, buffer overflow protection, better handling of race conditions and additional auditing or intrusion detection.

I suggest reading the documentation for each tool and selecting the one that best suits your environment. Some tools require extensive setup and configuration, like SELinux and other ACL/RBAC-style tools, and others can be introduced without configuration, though you will need to still ensure your applications and daemons function correctly.

This was first published in March 2006

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: