It's only evening here. I believe the quote is along the lines of 'The more I learn, the less I know'
a certain IT Sec contribuiter seems to have a penchant for picking at some of my weak areas of knowlege, so I must review the L4 kernel API, which I though I understood
You're quite right, assuming the reference is to be believed.
Although I've not seen or had the pleasure to use it, IPC would have to be implemented by the core component and that would then check and maintain the integrity of the tokens.
More detail than that, particularly with x86 I can't imagine how it's done.
@thisjosh I' more wondering where you'd store the tokens so as to be part of the process's address space and yet unmodifiable by it. I'm not entirely sure about setting ring 0 pages in the user's virtual memory.
well, that token needs to be protected because that's your reference the OS will use to look up the access you're allowed, so you can't let the process modify it.
@thisjosh Probably; x86_64/i386 both do in varying ways. You can ignore the write protection features using the cr0 control register which is how you can load a kernel module in and redirect the read only system call table on current kernels.
As I understand it kernel modules are ELF binaries, but linked against kernel addresses rather than something in userspace, so no libraries. So when your init function executes, you're in ring 0. Turn off cr0 write protection, alter the system table and turn it back on again. Tada, you hook a system call.
That kind of modification (control register modification) isn't allowed in ring 3, you see, so if your compiled code tries to do it it'll be rejected.
The hard bit in the above blog is twofold; you've got to find the address of the table from the symbols file (system.map) and that changes per kernel build - you can't hard code the address in any more.
@thisjosh I've not looked but I reckon if we did we'd find it does, especially on x64. The write issue you can't do much about - the kernel is monolithic (all ring 0) by nature, so the only defence comes in ensuring bad stuff does not get loaded in as a kernel module.
A lot of recent work was done at University of New South Wales in Australia which spun off the technology to a company called the Open Kernel Group
'under budget' would be funnier
So some version of L4 are available in source, but the ones used comercially are only typically only available in binary form. Although much of the closed source evolved from known open source.
@thisjosh No problem. I think the exception might be to the phrase "explicitly defined" which in a way they are at some point and then communicated out.
It sorta sounds like the Android permission model if you like. I think if you read it fast that might be how it comes across but that isn't what I thought you meant.
That doesn't sound any clearer reading it back, but pah, I know what I mean.
